List the administrators the caller can address for a request target

Powers the "Administrator" dropdown in the request dialog. Returns the shortlist of administrators for the target the dialog has selected, resolved by walking outward from that target — collection → building → portfolio → organization — and answering from the narrowest scope that has anyone eligible, intersected across every target so an approver must cover all of them. The caller and administrators with no email on file are excluded. tier names the scope the list came from so the picker can explain itself. Auth is minimal_access on the workspace in the body + a user session, AND read on EVERY target — no resource type is exempt, organization included. That per-target check matters because the response is target-specific: without it a member could post an arbitrary in-workspace resource id and learn who manages something they cannot see, and an organization target has no narrower scope to fall to, so its shortlist is the workspace's whole admin roster. An earlier revision of this route did exempt organization on the grounds that its id is pinned to the caller's own workspace — true, but it only rules out probing other ids, not obtaining a roster you have no standing to see. That exemption was the disclosure this route exists to close; do not reintroduce it. Privacy note: this deliberately exposes the shortlisted administrators' firstName/lastName/email to a non-admin caller, because they need to pick a specific administrator to notify — but only for resources they can already see. Do not widen the scope or drop the per-target check without re-designing the dialog UX.