feat: interface PIN, bulk disposition tagging, Google Drive delta scan, OCR memory fixes

- Interface PIN: optional session-level auth gate for the main scanner UI
  (Settings → Security → Interface PIN). Salted SHA-256 in config.json,
  rate-limited (5 attempts/5 min per IP). /view and viewer auth exempt.
  New /login page, before_request hook, GET/POST/DELETE /api/interface/pin,
  POST /api/interface/pin/verify, POST /api/interface/logout.

- Bulk disposition tagging: Select mode (filter bar "Vælg" button) reveals
  per-card checkboxes. Bulk tag bar at bottom of grid; POST /api/db/disposition/bulk.
  Disposition stats bar (total · unreviewed · retain · delete · % reviewed)
  updates after every save.

- Google Drive delta scan: uses Drive Changes API when delta is enabled.
  Per-user token stored as gdrive:{email} in delta.json. Load-then-merge
  save avoids racing with concurrent M365 token writes.

- PDF OCR OOM fix: render one page at a time with convert_from_path
  (first_page=N, last_page=N). Added _ocr_mem_ok() psutil guard (500 MB
  threshold) before each page render across scan_pdf, redact_fitz_pdf,
  redact_pdf.

- Email test message translation fix: routes/email.py returns structured
  {ok, method, recipients} instead of a hardcoded English string;
  scheduler.js builds the translated message client-side.

- Docs: CHANGELOG, README, TODO, MANUAL-EN, MANUAL-DA all updated.
  Lang files (en/da/de) extended with bulk, interface PIN, and SMTP keys.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

routes/database.py

@@ -143,6 +143,26 @@ def db_set_disposition():
     return jsonify({"status": "saved"})
 
 
+@bp.route("/api/db/disposition/bulk", methods=["POST"])
+def db_set_disposition_bulk():
+    """Set the same disposition on multiple items at once.
+    Body: {item_ids: [...], status, legal_basis?, notes?, reviewed_by?}
+    """
+    if not DB_OK: return jsonify({"error": "database not available"}), 503
+    data     = request.get_json() or {}
+    item_ids = data.get("item_ids", [])
+    status   = data.get("status", "")
+    if not item_ids or not status:
+        return jsonify({"error": "item_ids and status required"}), 400
+    db = _get_db()
+    for iid in item_ids:
+        db.set_disposition(iid, status,
+                           legal_basis=data.get("legal_basis", ""),
+                           notes=data.get("notes", ""),
+                           reviewed_by=data.get("reviewed_by", ""))
+    return jsonify({"saved": len(item_ids)})
+
+
 @bp.route("/api/db/disposition/<item_id>")
 def db_get_disposition(item_id):
     """Get the current disposition for an item."""