Batch-resolve applicant display names for KYC checks

Requires an API client bearer token.

Resolves display names (given + family name, nothing else) for up to 100 checks by id — the review queue's row labels. Reads run under the narrow custody `queue_display` purpose and every resolved row is reported to pii-vault's audit pipeline on the same best-effort basis as `getCheckApplicant`. A check that cannot be resolved — unknown, outside the caller's programme-admin role, no submission yet, or crypto-erased — is omitted from `data` rather than failing the batch.