Bulk Transition Tickets

The clean-slate desk's bulk action -- one status change, applied to every id in ticket_ids, via service.bulk_transition_tickets (itself a per-ticket loop over the SAME transition_ticket every single-ticket POST .../transition call already uses -- no second write path).

Per-ticket-kind grant, checked BEFORE any write, same as every other handler in this module -- but resolved in ONE query (service.ticket_kinds) rather than one round trip per ticket in a 300-row sweep: an id this principal cannot see is reported as its own per-ticket failure ('not_found' / 'forbidden'), never silently dropped and never allowed to abort the ids that DO pass. skip_auto_assign=True on every one of them is the whole point of going through bulk_transition_tickets instead of a loop calling the single-ticket route's own service.transition_ticket directly -- see that function's own docstring: a sweep must never make 300 tickets belong to whoever clicked the button (Frederick, 2026-08-09, live: "I hit exactly this tonight and put 103 tickets on Frederick's name").