Bulk activate

Sets active=true on every id in the body, applying the SAME per-target authorization (ResourceAuth manage, so a tenant_admin can only touch accounts in their own tenant) and the same admin-role-escalation fence as the single-account PUT /accounts/{id}/active. Never all-or-nothing: each id is authorized and applied independently, and the response reports succeeded/failed counts plus a per-id ok|forbidden|error result rather than aborting the batch on the first failure.