fix: the admin requests list names who asked, not a cut-off user id (#6265)

/admin/requests showed "by user f7e1ec86" — the first eight characters of
the requester's id, a placeholder from the first build. The admin list now
sends each requester's username, looked up for the whole page in one query,
and the row reads "by <username>". The id stays as the fallback for a list
that comes back without names.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/db/dbq/users.sql.go

@@ -388,6 +388,37 @@ func (q *Queries) ListActiveUsersWithTimezones(ctx context.Context) ([]ListActiv
 	return items, nil
 }
 
+const listUsernamesByIDs = `-- name: ListUsernamesByIDs :many
+SELECT id, username FROM users WHERE id = ANY($1::uuid[])
+`
+
+type ListUsernamesByIDsRow struct {
+	ID       pgtype.UUID
+	Username string
+}
+
+// Names a list's people in one round trip, e.g. who made each request on
+// /admin/requests.
+func (q *Queries) ListUsernamesByIDs(ctx context.Context, dollar_1 []pgtype.UUID) ([]ListUsernamesByIDsRow, error) {
+	rows, err := q.db.Query(ctx, listUsernamesByIDs, dollar_1)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []ListUsernamesByIDsRow
+	for rows.Next() {
+		var i ListUsernamesByIDsRow
+		if err := rows.Scan(&i.ID, &i.Username); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const listUsers = `-- name: ListUsers :many
 SELECT id, username, display_name, is_admin, auto_approve_requests,
        debug_mode_enabled, created_at