feat: bulk unban via checkboxes

Adds per-row checkboxes, a select-all toggle, a live "N selected" counter,
and an /unban-bulk endpoint that DELETEs each chosen decision id. Single-row
Unban buttons still work via hx-vals so they don't accidentally submit the
bulk form.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/app.py

@@ -122,6 +122,25 @@ def unban():
     return list_decisions()
 
 
+@app.post("/unban-bulk")
+def unban_bulk():
+    ids = [i for i in request.form.getlist("id") if i.isdigit()]
+    if not ids:
+        return list_decisions()
+    deleted = 0
+    errors = []
+    for did in ids:
+        r = _machine("DELETE", f"/v1/decisions/{did}")
+        if r.status_code in (200, 204):
+            deleted += 1
+        else:
+            errors.append(f"{did}:{r.status_code}")
+    log.info("unban-bulk by=%s count=%d errors=%s", caller_ip(), deleted, errors)
+    if errors:
+        return f"deleted {deleted}/{len(ids)}; errors: {', '.join(errors[:5])}", 502
+    return list_decisions()
+
+
 @app.post("/unban-me")
 def unban_me():
     ip = caller_ip()