repo mirror detach: name the accounts in the access tables

The detach API names every subject by ULID, so a plan for a mirror with a few dozen collaborators was a column nobody could check before removing access. Read the repo's people once (best-effort, before the write) and show accounts by provider:handle and display name, sorted, with who loses access and who keeps it as separate sections. --json keeps the wire IDs and skips the read.

GET /repos/{repoId}/people did not decode at all: the server sends "directGrant": null for anyone without a direct grant, which the spec types as the object alone. normalize.go now wraps listed $ref fields in anyOf [$ref, null] (UPSTREAM.md 2c).