Finalize Contact Import

Finalize an imported contact batch and trigger guarded auto-enrichment.

Trust boundary: LinkedIn/Google browser import modals currently insert contacts directly through Supabase, so the backend cannot write a receipt in the same commit. For a receipt not already written by a server import path, this endpoint creates it only after proving every supplied contact belongs to the authenticated organization. Newly inserted IDs must have created_at within the last 24 hours; matched existing IDs must carry a current-user contact_known_by edge for the claimed Google/LinkedIn import source. Those checks limit which direct-client writes may be claimed as an import; they are not proof that the client performed the original write.