feat: FHIR Bulk Data $import and CLI backup/restore

[degoke]

Adds FHIR Bulk Data $import and CLI backup / restore.

Merged main after #50–#53, #51, and #55. Conflicts were overlapping CapabilityStatement/docs edits: $import is now a capabilityFlags.BulkImport system operation next to $export, not a second marshalCapabilityStatement signature.

HTTP $import

• POST /fhir/$import with Prefer: respond-async (also accepts respond-async, wait=…) and a Parameters body
• Each input part needs type plus inline NDJSON (valueString) or a url
• Poll GET /fhir/$import/status/{jobId}; cancel with DELETE
• Error NDJSON: GET /fhir/$import/files/{jobId}/{file}
• NDJSON lines are created or updated through core after stripping meta.versionId / lastUpdated (same as CLI restore)
• Kickoff and cancel require write authorization per input type, not bulk-export read
• Advertised on CapabilityStatement only when BulkImportService is wired
• Invalid Parameters map to 400; cancel is not overwritten by a later complete

CLI

haistack backup [dir]    # default dir: backup
haistack restore [dir]

Backup writes {ResourceType}.ndjson plus manifest.json. Restore upserts those files and strips meta.versionId so core assigns new versions.

Runtime

pkg/runtime registers jobs.TypeImportBulk (export.import) alongside bulk export. Job/file stores remain in-memory (same as $export). Runtime wires HTTPLoader for http(s) input.url (file/data schemes rejected; 60s timeout, 64MiB cap).

Review follow-ups

• In-memory job Update will not un-cancel a cancelled job
• Write auth is checked per input resource type
• HTTPLoader Close is checked for errcheck CI
• After main: $import is advertised via capabilityFlags.BulkImport / systemOperations