#2835 Combat log: batch the extension visibility lookup into one query

Problem

The combat log masks private extension names on publish, bonus and collective distribution grants (swamp-club PR #1269). To decide which names are public, defaultCombatLogVisibility.publicExtensionNames in lib/app/combat-log-masking.ts makes one ExtensionRepository.findByName call for each distinct extension name on the page:

const found = await Promise.all(names.map((n) => repo.findByName(n)));

So a combat log page makes N Mongo round trips instead of one. The issue side of the same mask already uses a single batched findByNumbers ($in). The performance and web reviews on #1269 both flagged this as MEDIUM.

It's bounded today: the page caps at 200 rows, the calls run in parallel, name has a unique index, and most pages carry 1–5 distinct names. But a prolific publisher's page can carry dozens, and each call costs a DO↔Atlas round trip (~50–80ms). That cost lands on every profile activity render and every 10s poll of /api/v1/users/{name}/combat-log.

Proposed solution

• Add findByNames(names: string[]): Promise<ExtensionData[]> to ExtensionRepository, implemented in Mongo as { name: { $in: names } }, matching LabIssueRepository.findByNumbers.
• Have publicExtensionNames call it once and keep only the non-private results.
• Keep the fail-closed behaviour: a rejected lookup must still mask every extension title.

Acceptance

• A combat log page makes at most one extension query, whatever the number of distinct names.
• tests/app/combat_log_masking_test.ts still passes, plus a repo test for findByNames covering: an empty input, a missing name, and a private extension.