- quizzes_create_quiz, update_quiz, delete_quiz (confirm repeats the
slug), publish, unpublish, import_quiz (the existing import route) and
quiz_stats on new manage routes
- stats close expired open test attempts first, then report per student
over completed whole-quiz attempts and per question over every
completed attempt
- input is checked before the database; TestManageAPIAgainstDatabase is
written and skipped under -short
- quizzes_list_quizzes and quizzes_show_quiz bound to GET /api/v1/quizzes
and /api/v1/quizzes/{slug} behind user.api_token, the per-user
golem15.quizzes.manage throttle, a scope and the access_quizzes permission
- the permission is grantable through pact.HasFrontendPermissions
- owner JSON shapes with solutions in manage_json.go, never used by a
student route
