feat(12.1-01): declared bulk actions on admin lists

- pact.HasAdminBulkActions with AdminBulkAction, its input and result
- config_list.yaml bulkActions, compiled fail-loud, needs showCheckboxes
- POST .../{controller}/bulk/{action}: ids resolved and locked through the
  list scope in one transaction; partial selection is 409
- list schema offers declared actions per principal, with confirm text
- admin SPA bulk actions menu with confirm, busy state and failure toasts
- acme.roster fixture, tracer test, OpenAPI, TS types, dist, READMEs, docs

modules/cabana/phase10_csrf_test.go

@@ -66,13 +66,13 @@ func TestPhase10CSRF(t *testing.T) {
 			}
 		})
 	}
-	// refresh, logout, settings put, create, bulk-delete, widget action,
-	// toolbar action, update, delete, link, unlink, file upload, file
-	// reorder, file caption, file remove, relation child create, update
-	// and delete, pivot update, child file upload, reorder, caption and
-	// remove
-	if unsafe != 23 {
-		t.Fatalf("walked %d state-changing routes, want 23: %v", unsafe, router.order)
+	// refresh, logout, settings put, create, bulk-delete, bulk action,
+	// widget action, toolbar action, update, delete, link, unlink, file
+	// upload, file reorder, file caption, file remove, relation child
+	// create, update and delete, pivot update, child file upload, reorder,
+	// caption and remove
+	if unsafe != 24 {
+		t.Fatalf("walked %d state-changing routes, want 24: %v", unsafe, router.order)
 	}
 
 	loginHandler := router.handlers[login]