a surface can ask Nexus for the id behind a name (V-511)

blocked_on stores a canonical entity id, so the form that fills it needs a way
to turn "Kate" into one. ipc.ResolveEntity is that seam: the store adapter
refuses it, because identity is not the store's to answer, and the daemon
overrides it with the Nexus client the voice path already holds.

Three outcomes are kept apart, because a caller deciding whether to store an
id has to tell them apart. No nexus block is ErrNotImplemented. A miss is
ErrNoEntity. Several matches come back Ambiguous with the names, and the
caller asks — picking one is how a task ends up blocked on the wrong person
with nobody able to see it happened.

An outage stays the transport error. "There is no such person" and "Nexus is
down" must not read the same.

internal/ipc/api.go

@@ -549,6 +549,31 @@ type setTaskStatusReq struct {
 	By string `json:"by,omitempty"`
 }
 
+// EntityRef — one canonical entity from Nexus. Maven never mints these: an id
+// exists because Nexus resolved a name to it.
+//
+// Ambiguous is the answer when the name matched more than one entity. It is a
+// separate state from "not found" because the surface handles them
+// differently: an unknown name may be a typo, and an ambiguous one has to be
+// asked about, never picked (ECOSYSTEM-SPEC, and the same rule the mutating
+// Hexis path follows).
+type EntityRef struct {
+	ID          string   `json:"id,omitempty"`
+	Type        string   `json:"type,omitempty"`
+	DisplayName string   `json:"display_name,omitempty"`
+	Ambiguous   bool     `json:"ambiguous,omitempty"`
+	Candidates  []string `json:"candidates,omitempty"`
+}
+
+type resolveEntityReq struct {
+	Query string   `json:"query"`
+	Types []string `json:"types,omitempty"`
+}
+
+type resolveEntityResp struct {
+	Ref EntityRef `json:"ref"`
+}
+
 // editTaskReq — the rewrite of the three fields capture set (Vikunja #509).
 // Due nil clears the date, so "no date given" and "remove the date" cannot be
 // the same request.
@@ -886,6 +911,11 @@ var ErrTaskNoDoneWhen = errors.New("ipc: task has no definition of done")
 // text (Vikunja #509). The surface says which row holds it rather than merging.
 var ErrTaskDuplicate = errors.New("ipc: another live task already has this text")
 
+// ErrNoEntity — Nexus resolved the name to nothing. Distinct from an outage,
+// which surfaces as the transport error: "there is no such person" and "Nexus
+// is down" must not read the same to a caller deciding whether to store an id.
+var ErrNoEntity = errors.New("ipc: no such entity")
+
 // ErrTaskResolved — a resolved task is not editable.
 var ErrTaskResolved = errors.New("ipc: task is resolved")