Display data for a choose_installation outcome's set of ids.

An ordinary authenticated action route, not part of /complete's always-200 outcome-slug contract: this is never a browser-redirect target, so a malformed or expired choice_token is a plain 400, and a token that checks out but names someone else, or an owner who no longer owns the tenant, is a plain 403 - the same shape every other owner-gated route on this router already answers with.

Every installation the linking account can reach, not only the ones this tenant lacks. already_connected marks the ones already active here so the UI can offer picking the previous org again as a real, visible choice rather than this route silently filtering it out (CLO-627).

Bounded by however many installations of one app a single GitHub account can realistically reach, not by anything caller-controlled: one authoritative-record fetch per id in the token, each skipped rather than failing the whole response when an installation no longer resolves (removed between minting the token and this call).