Bulk, idempotent ingest of a device's workouts

For Apple Health/Health Connect syncing: each item upserts by (source, externalId), so a retried or re-synced request is safe — a second identical request reports every item "unchanged". At most 500 items; a bad item is reported "rejected" with a reason and the rest of the batch still runs, so only a malformed request as a whole is a 400. source is never "manual" or "garmin" — those keep their own paths.