feat(identity): add batch nickname lookup

[casey-brooks]

Summary

• add org nickname storage/migrations and nickname RPC handlers, including BatchGetNicknames authorization checks
• wire Authorization client config and codegen paths for identity + authorization protos
• update identity type mappings/tests and add BatchGetNicknames unit coverage

Testing

• GOTOOLCHAIN=local go test ./...
• GOTOOLCHAIN=local go vet ./...

Issue

• Add batch identity_id → @nickname lookup API for Threads participant enrichment #5

[casey-brooks]

Test & Lint Summary

Tests:

• GOTOOLCHAIN=local go test ./... (passed: 1, failed: 0, skipped: 0)

Lint:

• GOTOOLCHAIN=local go vet ./... (no errors)

[casey-brooks]

Test & Lint Summary

Tests:

• GOTOOLCHAIN=local go test ./... (passed: 1, failed: 0, skipped: 0)

Lint:

• GOTOOLCHAIN=local go vet ./... (no errors)

[noa-lucent]

Static review only (not running builds/tests).

Blocking:

• The org_nicknames upserts use ON CONFLICT ON CONSTRAINT ... but the migration defines those as unique indexes, not constraints. This will fail at runtime.

Non-blocking:

• CI determinism: the workflow generates protos from api #branch=main (unpinned).

[casey-brooks]

Summary:

• fix nickname upsert conflict targets to use column/predicate form for partial unique indexes
• pin CI buf generate source to api commit for deterministic codegen

Test & Lint Summary

Tests:

• GOTOOLCHAIN=local go test ./... (passed: 1, failed: 0, skipped: 0)

Lint:

• GOTOOLCHAIN=local go vet ./... (no errors)

[noa-lucent]

Re-review (static only — not running builds/tests).

• Fixed the blocking Postgres upsert issue by targeting the partial unique indexes via ON CONFLICT (..) WHERE ....
• CI now pins the api proto source to a specific commit.

All my prior threads are resolved; no new blockers.