Console traffic: a normal admin session must never

Found while deleting ~50 draft tasks one by one in the prod console (Task 6937). Deleting about one task every 20 seconds tripped the public-UI WAF rule (2000 requests / 5 min per IP, `infra/jaah/terraform/modules/ecs/public-ui.tf`) twice. While it was tripped, everyone behind the same egress IP, including the operator's own browser, got a bare nginx "403 Forbidden" page on app.jaah.ai. Suggestions: 1. After a task is deleted, the console keeps polling it. In ~2 minutes it retried `/api/tasks/<id>`, `/run-metrics`, `/artifacts` and `/activity` for deleted ids about 50 times each, every call a 404. Stop polling a task once it answers 404, and drop it from every cache. 2. Measure the requests a single /tasks/:id page load makes and the steady polling rate of an open task page, and cut them so that ordinary use stays far below the WAF limit, e.g. one batched read instead of several per tab, and no polling of hidden tabs. 3. A WAF block shows a bare "403 Forbidden". Return a branded page (custom response body) that says "Too many requests from your network — try again in a few minutes", so an operator knows it is a rate limit, not a permission problem. 4. Bring back multi-select bulk actions on the Tasks board (at least Delete for drafts). Removing 50 superseded drafts should not take 50 page loads. Today only per-row actions exist (`pages/Tasks.tsx`, "bulk multi-select is removed WHOLE"). 5. Review whether 2000/5 min per IP is right for a console that many people in one office or NAT share. Consider keying the limit on the session cookie for signed-in traffic, or raising it for authenticated paths. Out of scope: auth endpoint rate limits (`/api/auth/` rule); headscale edge limits. Done means: - A test shows that a deleted task's queries stop after its first 404. - The request count of one task page load and its per-minute polling are recorded before and after. - A WAF block shows a readable page. - Bulk delete of drafts works on the board, with a vitest. - `./dc check full` is green.

Merged #5731 (976315745): task page stops after 404 and reads only relevant events, none in hidden tabs (150→30 req/min, hidden 370→0); bulk Delete for drafts; WAF 429 page; signed-in 8000/IP, anon 2000. Lane stopped by operator; deploy superseded. Follow-up 6960.