feat: list and show quizzes over MCP for their owner

- quizzes_list_quizzes and quizzes_show_quiz bound to GET /api/v1/quizzes
  and /api/v1/quizzes/{slug} behind user.api_token, the per-user
  golem15.quizzes.manage throttle, a scope and the access_quizzes permission
- the permission is grantable through pact.HasFrontendPermissions
- owner JSON shapes with solutions in manage_json.go, never used by a
  student route

controllers/api/manage_test.go

@@ -0,0 +1,22 @@
+package api
+
+import (
+	"net/http"
+	"testing"
+
+	"git.golem15.com/golem15/summercms/modules/backpack"
+)
+
+// TestManageHandlersWithoutDatabase: every manage handler answers 503
+// when the application has no database.
+func TestManageHandlersWithoutDatabase(t *testing.T) {
+	h := New(backpack.New(nil))
+	for name, fn := range map[string]http.HandlerFunc{
+		"list": h.ManageListQuizzes, "show": h.ManageShowQuiz,
+	} {
+		code, _ := call(t, fn, "GET", "/", "", 7, map[string]string{"slug": "x"})
+		if code != http.StatusServiceUnavailable {
+			t.Errorf("%s without a database = %d, want 503", name, code)
+		}
+	}
+}