fix(slice5): validate raw metadata input + prune stale bulk selections

Code-review follow-ups:
- Validate the raw submitted value before apply_values coerces it, in both
  the single-edit and bulk endpoints — a scalar set onto a tags field now
  rejects (422 / rejected) instead of silently char-splitting into a list.
- Catalog prunes bulk selections to the currently-visible (filtered) entries
  after each list fetch, so the bulk bar can't act on rows the user has
  filtered out of view.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

frontend/src/components/Catalog.jsx

@@ -93,7 +93,16 @@ export default function Catalog({ viewer, onProposeRFC, version }) {
       Object.entries(selections).map(([f, set]) => [f, [...set]])
     )
     listRFCs(pid, cid, { selections: selObj, malformed: malformedOnly })
-      .then(d => { setRfcs(d.items); setFacets(d.facets || {}) })
+      .then(d => {
+        setRfcs(d.items); setFacets(d.facets || {})
+        // §22.4a SLICE-5: drop any bulk selections that the new (filtered)
+        // list no longer contains, so the bar can't act on hidden rows.
+        const visible = new Set(d.items.map(it => it.slug))
+        setSelected(prev => {
+          const kept = [...prev].filter(s => visible.has(s))
+          return kept.length === prev.size ? prev : new Set(kept)
+        })
+      })
       .catch(() => { setRfcs([]); setFacets({}) })
       .finally(() => setLoading(false))
   }, [version, pid, cid, selections, malformedOnly])