Let API clients resolve user ids to names (#1894)

Archives, the queue and statistics report ownership as a numeric
created_by_id, and statistics accept it as a filter, but nothing let an
API key discover whose id was whose -- the only user listing returns
emails, roles, group membership and full permission sets, so it is
administrative and rejects keys.

Add GET /users/slim returning id + username only, gated on a new
users:read_slim permission mapped to can_read_status. That grants no
data a key could not already reach: for API-keyed requests the
permission deps return None as current_user, so the stats:filter_by_user
guard short-circuits and ?created_by_id=N is already honoured for every
N. What was missing was the ability to address the filter, not
permission to use it. The full listing stays unmapped = admin-only.

Also fix /auth/me, which answered an API key with a synthetic
administrator: id 0, role admin, is_admin true and every permission in
the enum. A key cannot reach an administrative route at all, so clients
building their UI from that response rendered actions that 403 on use.
It now reports the key owner's identity, is_admin false, and the
permissions the key's scopes actually admit. Ownerless legacy keys keep
id 0 but no longer claim admin.

---

Source user names from the slim listing where only names are needed (#1894)

Stats filter-by-user, the Archives print log filter, the File Manager
username autocomplete, the camera-token owner column and the Finance
member picker all render nothing but a username, but all of them read
the full user listing, which is gated on the admin-level users:read.
An operator granted stats:filter_by_user but not users:read got an
empty filter with no indication why.

Point them at /users/slim under a separate react-query key, since the
full listing shares the 'users' key and the two shapes would clobber
each other in the cache.

backend/tests/integration/test_queue_creation_attribution.py

@@ -30,6 +30,7 @@ from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker
 from backend.app.core.auth import generate_api_key
 from backend.app.core.config import settings as app_settings
 from backend.app.models.api_key import APIKey
+from backend.app.models.group import Group
 from backend.app.models.print_queue import PrintQueueItem
 from backend.app.models.user import User
 
@@ -173,7 +174,14 @@ class TestWebhookQueueAddAttribution:
     async def test_credits_the_key_owner(self, async_client: AsyncClient, db_session, test_engine, printer_and_archive):
         printer, archive = printer_and_archive
 
-        owner = User(username="keyowner", password_hash="x", is_active=True)
+        # The owner needs queue:create in their own right: a key is capped by
+        # its owner's permissions (#1894), so a bare account with no groups
+        # cannot queue through a key however its scope flags are set. This test
+        # is about who the row is credited to, not about the gate.
+        group = Group(name="queue-writers", description="t", permissions=["queue:create"], is_system=False)
+        db_session.add(group)
+        await db_session.flush()
+        owner = User(username="keyowner", password_hash="x", is_active=True, groups=[group])
         db_session.add(owner)
         await db_session.commit()
         await db_session.refresh(owner)