feat(12.1-01): declared bulk actions on admin lists

- pact.HasAdminBulkActions with AdminBulkAction, its input and result
- config_list.yaml bulkActions, compiled fail-loud, needs showCheckboxes
- POST .../{controller}/bulk/{action}: ids resolved and locked through the
  list scope in one transaction; partial selection is 409
- list schema offers declared actions per principal, with confirm text
- admin SPA bulk actions menu with confirm, busy state and failure toasts
- acme.roster fixture, tracer test, OpenAPI, TS types, dist, READMEs, docs

modules/cabana/security_coverage_test.go

@@ -53,6 +53,7 @@ var phase09Routes = []adminRoute{
 	{key: "GET /{vendor}/{plugin}/{controller}"},
 	{key: "POST /{vendor}/{plugin}/{controller}"},
 	{key: "POST /{vendor}/{plugin}/{controller}/bulk-delete"},
+	{key: "POST /{vendor}/{plugin}/{controller}/bulk/{action}"},
 	{key: "POST /{vendor}/{plugin}/{controller}/widgets/{field}"},
 	{key: "POST /{vendor}/{plugin}/{controller}/toolbar/{action}"},
 	{key: "GET /{vendor}/{plugin}/{controller}/{id}"},
@@ -290,6 +291,7 @@ func phase09ProtectedCalls() []phase09Call {
 		{"list", (*service).list},
 		{"create", (*service).create},
 		{"bulk-delete", (*service).bulkDelete},
+		{"bulk-action", (*service).bulkAction},
 		{"widget-action", (*service).widgetAction},
 		{"toolbar-action", (*service).toolbarAction},
 		{"partial", (*service).partial},