Add bulk request access to portal documents

Visitors could only request access to one document, report, or file at
a time. Add row checkboxes and a bottom selection toolbar to the
compliance portal documents page so a visitor can select several rows
and request access to all still-locked ones in a single round-trip.

Expose a selection-scoped requestAccesses mutation that forwards the
chosen id lists to the existing RequestPortalAccess service (one
transaction, one NDA/auth gate). The resolver loads and tenant-checks
every target before requesting so a foreign id is rejected before any
access row is written, and echoes the affected nodes so the client
flips each row to pending in place.

Add a styled Base UI Checkbox to the v2 kit, a local selection context
shared by the independent row fragments, and mirror the new selection
strings across all locales.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/server/api/complianceportal/v1/graphql/compliance_portal.graphql

@@ -489,6 +489,10 @@ extend type Mutation {
   requestCompliancePortalFileAccess(
     input: RequestCompliancePortalFileAccessInput!
   ): RequestFileAccessPayload! @authentication(required: PRESENT) @nda
+
+  requestAccesses(
+    input: RequestAccessesInput!
+  ): RequestAccessesResultPayload! @authentication(required: PRESENT) @nda
 }
 
 type RequestDocumentAccessPayload {
@@ -507,6 +511,14 @@ type RequestAccessesPayload {
   compliancePortalAccess: CompliancePortalAccess!
 }
 
+# Returns the affected nodes so the client can update each row in place. Mirrors
+# the per-resource payloads but for a selection-scoped batch request.
+type RequestAccessesResultPayload {
+  documents: [Document!]!
+  audits: [Audit!]!
+  files: [CompliancePortalFile!]!
+}
+
 input ExportDocumentPDFInput {
   documentId: ID!
 }
@@ -527,6 +539,12 @@ input RequestCompliancePortalFileAccessInput {
   compliancePortalFileId: ID!
 }
 
+input RequestAccessesInput {
+  documentIds: [ID!]!
+  reportIds: [ID!]!
+  compliancePortalFileIds: [ID!]!
+}
+
 input ExportCompliancePortalFileInput {
   compliancePortalFileId: ID!
 }