Import Watchlist

Load a whole dependency tree at once: the body is a CycloneDX JSON or SPDX JSON document (up to 5 MB). Every component with a pkg:npm, pkg:pypi, pkg:cargo or pkg:github purl is normalised and matched against the archive's entities; matches are added to the watchlist up to the plan's cap, and the ones that did not fit are reported as over_cap rather than refused, so a Free account still gets its three and sees what Pro would unlock. Supported names with no entity yet are remembered per account (watchlist_pending) and listed under unmatched. With ?dry_run=true nothing is written. A document that cannot be read is a 400 with the reason; the whole import either applies or does not.