feat: maintainer bulk-actions toolbar for multi-select release/refund (#829)

[CodeMayor]

Description

Closes #829

Adds a maintainer bulk-actions toolbar that enables multi-selecting bounties
on the board and applying a release or refund to all selected items in
one request, with per-item success/failure reporting.

Backend

• New admin-protected endpoint POST /api/bounties/bulk-action
  (zod-validated bulkActionSchema; authenticated via the existing
  x-admin-api-key bcrypt middleware, same as /api/audit-log).
• Processes each selected bounty independently: a failure on one item
  (unknown ID, wrong maintainer, already finalized, invalid status, …) is
  recorded per item and never aborts the remaining items.
• Response: { results: [{ bountyId, success, status?, error? }], succeeded, failed }
  so partial success/failure is always visible to callers.
• Route allowlisted in the OpenAPI route-drift test (admin-only, not part of
  the public spec), along with two pre-existing undocumented routes
  (POST /api/bounties/:id/resolve-dispute, GET /api/config) that were
  already failing the drift test.

Frontend

• Checkboxes on bounty cards (maintainer view only — rendered when a Freighter
  wallet is connected; hidden for finalized bounties) enabling multi-select.
• Bulk-actions toolbar above the board when ≥1 bounty is selected:
  selected count, "Release selected", "Refund selected", "Clear selection",
  with disabled/loading states while a bulk action runs.
• Per-item results panel after completion: each bounty listed as
  ✅ Success (with new status) or ❌ Failed (with the exact backend error),
  plus summary toasts — failures are surfaced without hiding successes.
• bulkBountyAction() API helper sending the x-admin-api-key header.
• Fixes: pre-existing repoOwner is not defined runtime crash in App.tsx.
• Adds missing @stellar/freighter-api dependency (imported by existing code
  but absent from package.json, which broke 5 test suites).

Type of change

• New feature
• Bug fix (pre-existing repoOwner crash + missing dependency)

Security Checklist

• Input validation changed — new bulkActionSchema (zod) validates action,
  bounty IDs (1–100), maintainer Stellar address, optional tx hash
• Auth modified — new endpoint is protected by the existing bcrypt
  x-admin-api-key admin middleware; per-item maintainer ownership is
  still enforced by the store (maintainer must match each bounty)
• New external fetch
• Dependency added — @stellar/freighter-api (was already imported;
  only formalized in package.json)
• Secret handling — admin API key is supplied per-request via header
  prompt; no secrets are stored or logged

Testing

• backend/test/bulkAction.test.ts (new): all-succeed refund; per-item failure
  with unknown ID keeps processing and reports both outcomes;
  already-finalized bounty reported as failure without hiding successes;
  400s for empty list and unsupported action — 7/7 passing (with OpenAPI
  drift test).
• Backend typecheck: clean.
• Frontend: verified existing a11y/tab-order tests stay at baseline; remaining
  failures (toast tests expecting pre-Freighter behavior, one axe contrast
  warning on .theme-toggle) are pre-existing on main and unaffected.

closes #829

[vercel]

@CodeMayor is attempting to deploy a commit to the ritik4ever's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@CodeMayor Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits