Kit bulk check-out / check-in — one action moves the whole socket set

POST /api/v1/tools/{id}/checkout and /checkin now accept includeChildren: true. When set, the action fans out across the kit Tool itself plus every child whose parentKitId points at it — a mechanic grabbing a socket set creates 30 CHECK_OUT events (one per socket + the case) with one HTTP call. Each child still produces its own ToolEvent + tool.checked_out / tool.checked_in webhook + auto work order on BROKEN. Per-child failures (already-out, RETIRED, MISSING) land in skipped[] without aborting the rest. 6 new tests cover the kit-fan-out, the cross-tenant 404 path, and the no-children case where only the kit itself moves.