[Task] v1 publishing: bulk delete and bulk download endpoints

Context

Surfaced by the Publishing Queue migration spike (#36039). The new portlet has a top-of-list selection bar that exposes two multi-bundle actions:

• Bulk Remove — remove N selected bundles from the queue / history in one call
• Bulk Download — download N selected bundles in one archive

Today neither has a backend endpoint:

• DELETE /v1/publishing/{bundleId} (PublishingResource:437) is single-bundle only
• GET /bundle/_download/{bundleId} (BundleResource:754) is single-bundle only
• Legacy DELETE /bundle/ids (BundleResource:369) accepts a list but is async-via-WebSocket and is one of the consolidation candidates (see the spike's hardening backlog)

Proposed change

1. Bulk delete

Add DELETE /v1/publishing with a request body:

{ "bundleIds": ["id1", "id2", ...] }

Returns RetryBundlesView-style per-bundle result list:

{
  "entity": [
    { "bundleId": "id1", "success": true, "message": "Deleted" },
    { "bundleId": "id2", "success": false, "message": "Cannot delete in-progress bundle" }
  ]
}

Same in-progress-state validation as the single-bundle DELETE (409 per item).

2. Bulk download

Add POST /v1/publishing/download with body { "bundleIds": [...] }. Returns a single .tar.gz containing each bundle's archive as a top-level entry (or a zip of .tar.gz files, whichever is simpler given the existing tar.gz layout).

Alternative: documented client pattern of N parallel GET /bundle/_download/{bundleId} calls. Spike recommends a real endpoint to avoid the FE handling N concurrent streams.

Acceptance criteria

• Bulk delete returns per-bundle results
• Bulk delete enforces the same in-progress validation as the single delete
• Bulk download returns a single archive containing each bundle
• OpenAPI updated
• Integration tests for both endpoints (happy path + mixed success/failure + size limit if any)

Source links

• Spike audit: #36039
• FE consumer: #36040 (selection bar in the design)
• Epic: #34734

Start by reading PublishingResource:437 for single-bundle deletion, BundleResource:754 for downloads, and the legacy BundleResource:369 list deletion. Compare their validation and archive behavior, then inspect the OpenAPI definitions and integration-test conventions. Done means both v1 endpoints satisfy the listed per-bundle, archive, validation, size-limit, and mixed-result acceptance criteria.