Wire batch authorize into server APIs

Add authz.NewBatchAuthorizeFunc — the batch counterpart to the
existing AuthorizeFunc — together with WithBatchAttr,
WithBatchSkipAssumptionCheck, and WithBatchDryRun options. It maps the
new batch errors (mixed organization, empty batch, unsupported
resource type) to GraphQL Invalid responses, and reuses the existing
mappings for ErrAssumptionRequired / ErrInsufficientPermissions /
ErrResourceNotFound.

Plumb the new function into the Connect and Console resolvers and add
Resolver.AuthorizeBatch to the MCP resolver with equivalent error
mapping for tool callers.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/server/api/connect/v1/graphql_handler.go

@@ -31,11 +31,12 @@ import (
 func NewGraphQLHandler(svc *iam.Service, logger *log.Logger, baseURL *baseurl.BaseURL, cookieConfig securecookie.Config) http.Handler {
 	config := schema.Config{
 		Resolvers: &Resolver{
-			authorize:     authz.NewAuthorizeFunc(svc, logger),
-			logger:        logger,
-			iam:           svc,
-			baseURL:       baseURL,
-			sessionCookie: authn.NewCookie(&cookieConfig),
+			authorize:      authz.NewAuthorizeFunc(svc, logger),
+			batchAuthorize: authz.NewBatchAuthorizeFunc(svc, logger),
+			logger:         logger,
+			iam:            svc,
+			baseURL:        baseURL,
+			sessionCookie:  authn.NewCookie(&cookieConfig),
 		},
 		Directives: schema.DirectiveRoot{
 			Session: session.Directive,