[Improvement] Include owner information in metalake list responses

### What would you like to be improved?

`GET /api/metalakes` returns metalake names, comments, properties, and audit information, but does not include ownership. Clients displaying ownership alongside the list must request each metalake's owner separately. The MCP `list_metalakes` tool also lacks this information because it forwards the REST list.

### How should we improve?

Include an `owner` field in each listed metalake:

```json
"owner": {"name": "alice", "type": "user"}
```

Support user and group owners. Return explicit `null` when authorization is disabled or no owner is assigned. Resolve ownership only after filtering metalakes by the caller's visibility, and retain the existing response fields.

Start by tracing the GET /api/metalakes implementation and the MCP list_metalakes tool that forwards this response. Check where visibility filtering and owner lookup occur; done means each visible metalake includes the requested owner object for users or groups, or explicit null when authorization is disabled or no owner exists, while existing fields remain unchanged.

Written by the indexing model from the issue text.