Bulk Update Risk Status

Dismiss several risks with one reason and note.

Restricted to dismissed: bulk flag/clear is not a product action, and this path skips issue-creation and the flagged-after-ignore email that the single-risk status write still owns. TipTap seeding matches the card dismiss because both call apply_status_change. When selection is present (Select area), the drawn box is stored as training data in the same transaction; the server still does not re-hit-test geometry.