`bulkUpdateReviewStatuses` does not check per-item authorization, only bulk

[mercy60]

Internal ID: #83

Imported from ISSUES.md via scripts/import-issues.mjs.

Problem Statement. The service is mock; no real auth. Future implementation must enforce per-item permissions.

Expected Outcome. Backend validates admin role on each call.

Acceptance Criteria.

• Tests cover non-admin attempts.

Files / modules affected.

• Backend review module (TBD).

Dependencies. None.

Difficulty / Effort. Medium / S (≈ 3 hours).

Labels. area:backend, security