[AUD-003] Bulk POA&M import returns HTTP 200 on partial failure — callers cannot detect data loss

## Summary

**Severity:** P2 — Silent Partial Failure
**Phase:** Phase 4 Remediation (API Contract Hardening)
**Audit Reference:** SPIN Agent Product Integrity Report, Phase 1

## Finding

The bulk POA&M import endpoint returns HTTP 200 even when some records in the batch fail to import. Callers (including automated pipelines) receive a success signal but have silently lost data.

## Impact

- Any automated POA&M import pipeline cannot trust a 200 response
- Records may be silently dropped with no notification
- Compliance data integrity is at risk for any bulk import that has run to date
- Operators have no way to determine which records succeeded vs. failed

## Acceptance Criteria

- [ ] Return HTTP 207 Multi-Status with per-record success/failure details on partial failure
- [ ] Return HTTP 400 if all records fail
- [ ] Response body includes: total submitted, total succeeded, total failed, per-failed-record error detail
- [ ] Integration test: mixed valid/invalid batch asserts 207 with correct breakdown
- [ ] No regression on fully-successful batch (still returns 200 or 207-all-success)

## Related

- #674 — POA&M/findings FK linkage
- Audit artifact: SPIN Agent Product Integrity Report (Phase 1)

Locate the bulk POA&M import endpoint and its existing integration tests, then run the relevant test suite to establish current response behavior. Done means partial batches return 207 with per-record failure details, all-failed batches return 400, and fully successful batches retain an accepted success response.

Written by the indexing model from the issue text.