Admin List Handles

List every handle in the system (admin only, read-only).

Diagnostic added 2026-06-06: the tandem.cc -> tandem-cc.com cutover surfaced that real handles still live under the OLD @tandem.cc domain (the gated migration #7 that renames them hasn't run). This lets us eyeball exactly which local parts are taken and under which domain, so we know the full scope the availability fix (_handle_taken) now covers.

Grouped/ordered by domain then local part. Returns no tokens or secrets — just the public-ish handle id, display name, signed_by, is_tandem, created_at.