Add batch get-by-IDs RPCs to AdminService for users, service users, and projects

Problem

AdminService can list entire collections (ListAllUsers, ListAllServiceUsers, ListAllOrganizations), but there's no way to resolve a known set of IDs to entities in a single call. Given a list of IDs, the options today are to issue N single Get calls or to list a whole collection and filter — N round-trips, or over-fetching.

Proposal

Add batch get-by-IDs RPCs to AdminService (superuser-gated, consistent with the existing ListAll* admin RPCs, since these are cross-org lookups that aren't org-scoped):

• BatchGetUsers(user_ids: []string) → users: []User
• BatchGetServiceUsers(service_user_ids: []string) → service_users: []ServiceUser
• BatchGetProjects(project_ids: []string) → projects: []Project

Each takes a repeated ID field and returns the matching existing entity messages. A bounded max number of IDs per request (like BatchCheckPermission) would be reasonable.

Notes

• The lookup already exists internally — GetByIDs is implemented in core/user, core/serviceuser, and core/group; it just isn't exposed at the API layer. (core/group could get a BatchGetGroups too if useful.)
• core/project would need a batch lookup added; it currently has only single Get and a filtered List.

Start at the AdminService definitions and existing ListAllUsers, ListAllServiceUsers, ListAllOrganizations, and BatchCheckPermission RPCs. Read the GetByIDs implementations in core/user, core/serviceuser, and core/group, plus the single Get and filtered List paths in core/project. Done means superuser-gated batch RPCs for users, service users, and projects, with bounded IDs and coverage for matching results.