[BE-68] Add bulk operations endpoints — bulk status update, bulk assign, and bulk delete for assets

[yusuftomilola]

Overview

Operations teams frequently need to update dozens of assets at once — decommissioning a whole lab of equipment, reassigning a department's assets after restructuring, or mass-tagging assets after a physical audit. Individual PATCH calls for each asset are prohibitively slow at scale.

Context

• All bulk operations must be atomic per item (partial success is acceptable — failed items are returned in the response)
• Each successful change must still create an AuditLog entry and an AssetHistory record
• The endpoint body must accept an array of IDs plus the change to apply (not individual payloads per asset)

Acceptance Criteria

• PATCH /assets/bulk/status body: { ids: string[], status: AssetStatus } — updates status on all valid IDs, skips RETIRED assets (returns them in skipped array)
• PATCH /assets/bulk/assign body: { ids: string[], userId?: string, departmentId?: string } — reassigns assets; at least one of userId or departmentId required
• DELETE /assets/bulk body: { ids: string[] } — soft-deletes all listed assets; ADMIN only
• All three endpoints return: { succeeded: string[], failed: { id, reason }[], skipped: string[] }
• Maximum 200 IDs per request — return 400 with a clear message if exceeded
• All operations wrapped in a transaction — if the transaction fails, none of the changes persist