fix: the admin requests list names who asked, not a cut-off user id (#6265)

/admin/requests showed "by user f7e1ec86" — the first eight characters of
the requester's id, a placeholder from the first build. The admin list now
sends each requester's username, looked up for the whole page in one query,
and the row reads "by <username>". The id stays as the fallback for a list
that comes back without names.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/requests.go

@@ -16,8 +16,11 @@ import (
 // requestView is the JSON shape returned by all /api/requests handlers.
 // Field names follow the lowercase snake_case convention for /api/* responses.
 type requestView struct {
-	ID              pgtype.UUID        `json:"id"`
-	UserID          pgtype.UUID        `json:"user_id"`
+	ID     pgtype.UUID `json:"id"`
+	UserID pgtype.UUID `json:"user_id"`
+	// Username names the requester. Only the admin list fills it; a user's
+	// own /requests page has no need to name them back to themselves.
+	Username        string             `json:"username,omitempty"`
 	Status          string             `json:"status"`
 	Kind            string             `json:"kind"`
 	ArtistMBID      string             `json:"artist_mbid"`