feat(identity): enable field selector support for staff users

[OscarLlamas6]

Pass field selectors from REST layer to backend provider to enable staff users to query other users' identities and sessions. This is required for the staff portal to view user identity provider links and active sessions for support purposes.

Changes:

• Pass field selector from ListOptions to backend in useridentities
• Pass field selector from ListOptions to backend in sessions
• Update README documentation with field selector usage and security model
• Add test documentation for field selector authorization scenarios

Authorization model:

1. Milo RBAC: PolicyBinding grants access to identity resources
2. Backend authorization: Provider validates group membership
   • Regular users: Can only see their own data (no field selector)
   • Staff users: Can use field selectors to query other users
   • Groups: staff-users, fraud-manager (configured in Zitadel)

Security:

• Backward compatible: Regular users unaffected
• Defense in depth: Two layers of authorization
• Audit logging: All requests logged with user context
• Explicit deny: Non-staff users cannot use field selectors

This changes the previous 'self-scoped' design where field selectors were intentionally ignored. The new behavior maintains self-scoped access for regular users while enabling cross-user queries for staff.

Because the field selectors are not being passed to the provider, the following error is obtained:

❯ curl -H "Authorization: Bearer $(datumctl auth get-token)" https://api.staging.env.datum.net/apis/identity.miloapis.com/v1alpha1/useridentities\?fieldSelector\=status.userUID%3D340583683847098197
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "\"status.userUID\" is not a known field selector: only \"metadata.name\", \"metadata.namespace\"",
  "reason": "BadRequest",
  "code": 400
}%

[joggrbot]

📝 Documentation Analysis

All docs are up to date! 🎉

---

✅ Latest commit analyzed: ca31333 | Powered by Joggr

[OscarLlamas6]

Needed for datum-cloud/staff-portal#284

[scotwells]

@OscarLlamas6 based on this error message you also need to register status.userUID as a field selector.

"status.userUID" is not a known field selector: only "metadata.name", "metadata.namespace"

Looks like you do this by registering the supported fields with the AddFieldLabelConversionFunc, see the activity service for an example.