feat(console): add batch workspace block endpoints

[heimoshuiyu]

Summary

• Adds Workspace.blockBatch / Workspace.unblockBatch to packages/console/core/src/workspace.ts: set is_blocked for an arbitrary list of workspace IDs in one call, reporting { blocked | unblocked, notFound } per item
• Adds two support routes with the usual SUPPORT_API_KEY bearer auth:
  • POST /api/support/actions/block-workspaces — body { "workspaceIDs": ["wrk_...", ...] }
  • POST /api/support/actions/unblock-workspaces — same shape, the rollback path for a mistaken batch

Motivation

Fraud response regularly needs to block hundreds of workspaces at once. Calling the existing single-workspace endpoint per ID means hundreds of round trips from the caller and hundreds of separate UPDATE statements. This endpoint takes the whole list in one request and reports per-item results.

Design

• No size cap: the request accepts any non-empty list. Large IN lists degrade on Vitess, so the core chunks the work into fixed groups of 500 executed sequentially inside one Database.use — sequential keeps the statements on one connection inside ambient transactions.
• Existence-based reporting, not rowsAffected: after each chunk's UPDATE, a follow-up SELECT determines which IDs exist. MySQL reports 0 affected rows for no-op updates (no CLIENT_FOUND_ROWS), so rowsAffected cannot distinguish "already blocked" from "missing" — the select can.
• Partial missing does not fail the batch: unknown IDs land in notFound with HTTP 200 and the full result body. This deliberately differs from the single endpoints' not-found → 400; two stale IDs should not discard 298 successful blocks. The caller (the OpenCode support agent, see the companion PR) surfaces notFound for operator follow-up.
• Duplicate input IDs are deduplicated before the update.
• No schema change, no migration.

Usage

POST /api/support/actions/block-workspaces
Authorization: Bearer <SUPPORT_API_KEY>

{ "workspaceIDs": ["wrk_...", "wrk_..."] }

• 200 — {"success":true,"message":"Workspaces blocked","result":{"blocked":[...],"notFound":[...]}}
• 400 — invalid body (empty list, non-wrk_ IDs)
• 401 — missing/incorrect support key

Related

• Independent of feat(console): add workspace block support action #48462 (single-workspace block-workspace endpoint); no shared code paths.
• Consumed by the OpenCode agent's batch block support action (anomalyco/experiments#567); that PR executes 404 → failed until this endpoint merges and deploys, so this PR should land first.

[github-actions]

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

• PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.