Emit audit and SCIM log exports as CSV

JSONL was awkward in spreadsheets and SIEM imports. Write
tab-separated-friendly CSV with organization name on every row,
resolve audit actors to email or API key name, and enrich SCIM rows
with profile email and display name when available.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

pkg/coredata/personal_api_key.go

@@ -301,3 +301,47 @@ WHERE
 
 	return nil
 }
+
+func (a *PersonalAPIKeys) LoadByIDs(
+	ctx context.Context,
+	conn pg.Querier,
+	apiKeyIDs []gid.GID,
+) error {
+	if len(apiKeyIDs) == 0 {
+		*a = nil
+
+		return nil
+	}
+
+	q := `
+SELECT
+    id,
+    identity_id,
+    name,
+    expires_at,
+    expire_reason,
+    last_used_at,
+    created_at,
+    updated_at
+FROM
+    iam_personal_api_keys
+WHERE
+    id = ANY(@api_key_ids::text[])
+`
+
+	args := pgx.StrictNamedArgs{"api_key_ids": apiKeyIDs}
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query personal api keys: %w", err)
+	}
+
+	apiKeys, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[PersonalAPIKey])
+	if err != nil {
+		return fmt.Errorf("cannot collect personal api keys: %w", err)
+	}
+
+	*a = apiKeys
+
+	return nil
+}