feat(contracts): validate bulk operations at the boundary (#1196)

[ZacLou]

Summary

Closes #1196.

This moves validation for the contract bulk API to the request boundary, while preserving the endpoint's existing partial-success behavior.

Changes

• Added bulkContractItemSchema as a Zod discriminated union over action.
• create reuses the existing create-contract schema.
• update reuses the existing update-contract schema and accepts either contractId or id.
• delete requires version and accepts either contractId or id.
• Added a superRefine rule requiring an identifier for update and delete.
• Replaced ad-hoc controller checks with per-item safeParse.
• Invalid items now return a structured validation_error with field-level details.
• Valid items continue to be processed, so one invalid item does not reject the entire batch.
• The outer bulk schema continues to enforce the batch structure before the controller performs per-item validation.

Verification

• Targeted Jest suites: 3 suites / 16 tests passing.
• Targeted ESLint: no reported errors.
• Targeted TypeScript checking on the five changed files: no diagnostics.
• I did not fold unrelated repository fixes into this PR.