feat(api-keys): show creator column and filter to org owners

Switch the gate from `currentUser.is_admin` to `access.canSeeOrgAdmin`
so Org owners get the same all-keys view (Creator column, creator
filter, `user_id: '*'` default) that platform admins have. Mirrors
the BE's "platform admin OR current-Org owner" gate on listing every
key in scope.

The user picker now fetches `/user-directory` instead of the
admin-only `/users` endpoint, which would 403 Org owners. Rename the
filter placeholder from the misnamed `models.table.filterByName` to
`common.filter.byCreator`.

src/pages/users/services/use-query-user-list.ts

@@ -1,25 +1,29 @@
 import { useQueryDataList } from '@/hooks/use-query-data-list';
-import { useModel } from '@@/plugin-model';
-import { queryUsersList } from '../apis';
+import { useAccess } from '@umijs/max';
+import { queryUserDirectory } from '../apis';
 import { ListItem } from '../config/types';
 
+// Backed by `/user-directory`, which the BE opens to platform admin AND
+// Org owners (the admin-only `/users` endpoint would 403 the latter).
+// `canSeeOrgAdmin` mirrors the same gate on the FE so non-admin Org
+// owners can populate user pickers without hitting an error.
 export const useQueryUserList = (optons?: {
   getLabel?: (item: ListItem) => string;
   getValue?: (item: ListItem) => any;
 }) => {
-  const { initialState } = useModel('@@initialState');
+  const access = useAccess();
   const { dataList, loading, fetchData, cancelRequest } = useQueryDataList<
     ListItem,
     Global.SearchParams
   >({
     key: 'userList',
-    fetchList: queryUsersList,
+    fetchList: queryUserDirectory,
     getLabel: optons?.getLabel,
     getValue: optons?.getValue
   });
 
   const fetchUserList = (params: Global.SearchParams) => {
-    if (!initialState?.currentUser?.is_admin) return;
+    if (!access.canSeeOrgAdmin) return;
     return fetchData({
       ...params
     });