Publish MANY events onto the unified-events spine in one request.

Built for the contact-import modals, whose runs used to send one POST /api/events/publish per event (a 2k-contact LinkedIn import = ~2k round trips ≈ minutes of post-import stall). Same trust boundary as the single endpoint: org from auth, actor=('user', user_id), source='user', client actor fields ignored. Same per-event caps (namespace allowlist, ~8KB payload, ≤5 links) — the whole request 4xxs if ANY event violates them (the importers only send well-formed rows; fail loud, not partial). Events land via chunked INSERTs (emit_events_bulk), not per-row emits.