api: batch membership editing is not on the wire, and the gallery is now the caller #29 was waiting for

[JArmandoAnaya]

The gap

BatchService has add_assets and remove_assets. Neither is on the wire. #29 decided
that deliberately, and the reason it gave was a caller: "a batch is born from an ingest, and
curating one out of an arbitrary subset of assets has no caller until M5's gallery."

The batch-view redesign is that caller. Its bulk action bar wants a Delete frames control,
and there is no endpoint behind it — the only DELETE over assets anywhere in the contract is
DELETE /datasets/{dataset_id}/assets/{asset_id}, which curates the trunk, not a batch.

The split the redesign exposed, and it is the interesting half

"Remove this frame from the batch" means two different things depending on where the batch is
on its lifecycle, and only one of them is a membership edit:

• draft — membership is still editable. BatchService.remove_assets is the operation,
  and it is the honest answer.
• After approval — membership is frozen and remove_assets refuses, by design. Jobs
  are already partitioned against the pinned schema, and the partition is exact (disjoint,
  union = batch), so removing a member would invalidate the cut. The standing rule is that
  excluding an asset after approval is a per-asset skipped decision, never a membership
  removal.

So a UI offering one Delete frames button across both states would be offering an action
that is refused half the time. Whatever ships here has to carry that distinction, or the
screen has to draw two different controls.

What this issue is for

Decide and implement the wire surface for draft-batch membership editing:

• DELETE /batches/{batch_id}/assets?id=&id= (the repeated-query-parameter shape server: batch/job endpoints — approve, partition, "next N pending assets", annotation submission, progress (the third-party-app contract) #29 chose for
  bulk annotation delete — three DELETEs would be three transactions and a partial failure the
  SDK refuses to allow), or a body-carrying alternative if that reads better.
• Whether add_assets ships at the same time or stays off the wire. It has no caller even now:
  a batch is filled by an ingest, and the gallery only wants to take things out.
• The refusal a non-draft batch answers with, so a client can tell "you may not" from
  "that batch does not exist".

Constraints

• Kernel side already exists; this is a route, a wire model, openapi.json, and
  pnpm generate:client. No migration.
• MCP parity is evaluated, not automatic — mcp: real tools over the SDK — management, schema, ingest, jobs, annotation, releases (the Part III §4 list), confirm:true on destructive ops #35 dropped remove_dataset_asset as curation an
  agent has no business doing, and the same argument probably applies here. Record the call in
  the PR body either way.

Filed out of the batch-view redesign, where Delete frames was cut for having no API behind it.

[JArmandoAnaya]

Parent: #284 — the batch-view redesign, where this was cut for having no API behind it.