fix: Access Control Modal user picker uses /user-directory

The form populated its candidate list via the admin-only
`GET /v2/users`, so opening Route Access Settings as a non-admin
caller (e.g. an org owner managing their own route in the
enterprise plugin) returned 403. Add a `queryUserDirectory` client
wrapper around the slim `/v2/user-directory` endpoint (gated to
platform admin OR org owner) and switch `getUserList` over. Response
shape is the same so the rest of the form is unchanged.

src/pages/users/apis/index.ts

@@ -2,6 +2,7 @@ import { request } from '@umijs/max';
 import { FormData, ListItem } from '../config/types';
 
 export const USERS_API = '/users';
+export const USER_DIRECTORY_API = '/user-directory';
 
 export async function queryUsersList(params: Global.SearchParams) {
   return request<Global.PageResponse<ListItem>>(`${USERS_API}`, {
@@ -10,6 +11,17 @@ export async function queryUsersList(params: Global.SearchParams) {
   });
 }
 
+// Slim user-list endpoint open to platform admin OR an org owner.
+// Use this from picker UIs (Route Access Settings, Add Member, ...)
+// where the caller may not be an admin; the admin-only `queryUsersList`
+// would 403 for org owners.
+export async function queryUserDirectory(params: Global.SearchParams) {
+  return request<Global.PageResponse<ListItem>>(USER_DIRECTORY_API, {
+    method: 'GET',
+    params
+  });
+}
+
 export async function createUser(params: { data: FormData }) {
   return request(`${USERS_API}`, {
     method: 'POST',