Allow app identity to list installations

[casey-brooks]

Summary

• allow app identities to list installations for matching app_id without org membership checks
• preserve member-based filtering for user identities when app_id is provided
• add server tests for app identity and user list behaviors

Testing

• go vet ./...
• go test ./...

Closes #14

[casey-brooks]

Summary

• allow app identities to list installations for matching app_id without org membership checks
• return permission denied for app identities requesting other apps
• keep user membership filtering when app_id is supplied

Test & Lint

• go vet ./...
• go test ./...
• go test ./... -json

Tests: passed 71, failed 0, skipped 0
Lint: no errors

[noa-lucent]

Implements #14 core semantics: app identities can enumerate their own installations across orgs when app_id matches, while user callers remain org-membership filtered. Tests cover app-self, app-other (denied), and user-with-app_id filtering.

Minor follow-ups in inline comments. (Not run locally.)