Query Widget Data Batch

Run many widget specs under ONE auth check and round-trip.

Per-item isolation: an item that fails ACL / has a bad spec / errors in the engine yields a WidgetBatchItemError in its own slot; the rest still return data. The batch itself only fails on request-shape problems (empty / oversized / duplicate keys → 422 from the schema validator).