feat: reopen application and travel

[axv2655]

Details

• Implemented a new backend endpoint to bulk reopen applications (POST /superadmin/applications/reopen) by allowing admins to pass an array of application statuses, setting matching applications back to draft and clearing their submitted_at timestamps.
• Implemented a parallel backend endpoint to bulk reopen travel reimbursements (POST /superadmin/applications/travel/reopen) by allowing admins to pass an array of travel statuses, setting matching applications back to a pending travel status and clearing their approved amounts (provided the hacker hasn't submitted their travel RSVP yet).
• Added comprehensive unit tests for both new API endpoints, verifying successful state transitions, parameter validations, query conditions, and super-admin access controls.
• Combined both features on the frontend into a single "Reopen Applications & Travel" card within the Superadmin Danger Zone/Reset Settings tab.
• Replaced the previous single-select UI dropdown with robust multi-select Checkbox grids, enabling admins to select and reopen multiple statuses concurrently for both applications and travel reimbursements in one click.

Testing

• Ran backend unit test suite (go test ./cmd/api) to verify database mock interactions, 400 validation guards, and 403 access control checks for the new endpoints.
• Compiled frontend using TypeScript (tsc --noEmit) to verify that the API binding contracts match the expected array payload structures.
• Ran Prettier code formatter and ESLint over all edited React files to ensure compliance with the repository's CI frontend-audit checks.
• Verified that updating travel statuses properly guards against reopening travel requests where travel_rsvp_status is no longer pending.

[balebbae]

Super admins should be able to reopen a specific application not all of a specific status.

Like somewhere on the super admin grading page.

Mb prlly should've been more clear but I'll just work on it since I wanna change some stuff here anyways.