feat(pending): bulk reject selected operations in granskning (#1085)

* feat(pending): bulk reject selected operations in granskning

The granskning queue could approve selected operations in bulk but
rejection was one row at a time. Adds:

- POST /api/pending-operations/bulk-reject: one guarded UPDATE
  (status='pending' filter) so rows resolved in a parallel session are
  reported as skipped instead of being flipped; optional
  rejection_category/rejection_reason applied to every rejected row so
  agents still learn from bulk 'no'. No high-risk skip server-side:
  rejecting posts nothing to the ledger.
- 'Avvisa valda' button next to 'Godkänn valda'; the existing reject
  dialog doubles as bulk confirmation (category + note apply to all).
- Route tests: 401/403/400/500, not-found, already-handled skip,
  read-write race, happy path.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(pending): disable both bulk buttons while either bulk action is in flight

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/api/schemas.ts

@@ -1868,6 +1868,16 @@ export const PendingOperationsBulkSchema = z.object({
   ids: z.array(z.string().uuid()).min(1).max(100),
 })
 
+// Bulk reject: same id list plus the optional category/reason pair from the
+// single reject route. When provided they are applied to every rejected row.
+export const PendingOperationsBulkRejectSchema = z.object({
+  ids: z.array(z.string().uuid()).min(1).max(100),
+  rejection_category: z
+    .enum(['wrong_category', 'wrong_amount', 'duplicate', 'wrong_period', 'other'])
+    .optional(),
+  rejection_reason: z.string().max(2000).optional(),
+})
+
 // ============================================================
 // Audit trail schemas
 // ============================================================