perf(clients): batch the client record lookup in bulk operations

BulkResetTraffic resolved every address with its own GetRecordByEmail
call, one SELECT per email, purely to find the disabled clients it has to
re-enable. Resetting 30 clients issued 30 queries before the batched
transaction even started, while BulkAdjust, BulkDelete and BulkSetEnable
next to it already loaded their rows with a single chunked IN query.

Those three carried a verbatim copy each of both the trim/dedupe loop and
the chunked record load, so the reuse is the fix: trimmedUniqueEmails now
delegates to the existing uniqueNonEmptyStrings, and clientRecordsByEmail
holds the one chunked lookup all four call sites share.

A DB failure during the lookup now aborts the reset instead of being
swallowed per email; a missing row is still skipped, as before.

The new test drives BulkResetTraffic with 3 and with 30 emails and fails
unless both issue the same number of SELECTs against clients.

internal/web/service/inbound_util.go

@@ -1,5 +1,7 @@
 package service
 
+import "strings"
+
 // sqliteMaxVars is a safe ceiling for the number of bind parameters in a
 // single SQL statement. SQLite's SQLITE_MAX_VARIABLE_NUMBER is 999 on builds
 // before 3.32 and 32766 after; staying under 999 keeps queries portable
@@ -38,6 +40,16 @@ func uniqueNonEmptyStrings(in []string) []string {
 	return out
 }
 
+// trimmedUniqueEmails trims each address before deduplicating, so the bulk
+// client operations treat " a@x " and "a@x" as the same row.
+func trimmedUniqueEmails(in []string) []string {
+	trimmed := make([]string, 0, len(in))
+	for _, e := range in {
+		trimmed = append(trimmed, strings.TrimSpace(e))
+	}
+	return uniqueNonEmptyStrings(trimmed)
+}
+
 // uniqueInts returns a deduplicated copy of in, preserving order of first occurrence.
 func uniqueInts(in []int) []int {
 	if len(in) == 0 {