feat(BA-6618): app_config_fragment bulk CRUD service layer

[jopemachine]

Summary

Bulk create / update / purge for app_config_fragment at the service layer, on top of the repository primitives in #12426. Partial success: each item is independently authorized by its allow-list write-gate, and rejected/failed items are reported per-item rather than failing the whole batch.

• Bulk actions carrying BulkConditional{Creator,Updater,Purger} payloads; service methods; BulkActionProcessor wiring (per-entity RBAC extension point — no validator wired yet).
• Action results carry succeeded + failed[index, message].

📚 Stacked PRs

Part of the AppConfigFragment / AppConfig stack under BEP-1052 (epic BA-5781). Merge in order:

1. ✅ feat(BA-6552): add app_config_fragments DB model and Alembic migration #12306 — feat(BA-6552): app_config_fragments DB model and Alembic migration
2. ✅ feat(BA-6553): add app_config_fragments repository layer #12307 — feat(BA-6553): repository layer
3. ✅ refactor(BA-6619): consolidate AppConfigScopeType into common.data (single definition) #12403 — refactor(BA-6619): consolidate AppConfigScopeType into common.data
4. ✅ refactor(BA-6620): ExistsQuerier ops primitive + AppConfigAllowList.exists #12405 — refactor(BA-6620): ExistsQuerier + AppConfigAllowList.exists
5. ✅ feat(BA-6554): add app_config_fragment service layer #12358 — feat(BA-6554): AppConfigFragment service layer
6. feat(BA-6628): conditional-bulk repository primitives #12429 — feat(BA-6628): conditional-bulk repository primitives
7. feat(BA-6626): app_config_fragment bulk repository layer #12426 — feat(BA-6626): app_config_fragment bulk repository layer
8. 👉 feat(BA-6618): app_config_fragment bulk CRUD service layer #12401 — feat(BA-6618): AppConfigFragment bulk CRUD service layer ← you are here
9. feat(BA-6555): add app_config service layer #12359 — feat(BA-6555): app_config service layer
10. feat(BA-6556): AppConfig REST v2 API (raw fragments and merged read/update) #12377 — feat(BA-6556): AppConfig REST v2 API