Bulk Mark Read

Mark several alerts read/unread in one call.

Powers multi-select on the /alerts feed. Scoped exactly like the single-row route — the caller can only flip alerts they're allowed to see, so an attacker passing someone else's id just no-ops (it won't match the WHERE clause). Returns how many rows actually changed owner-side so the UI can reconcile its optimistic update.