feat: tags, unpublish and image upload for the author

- GET /_bm/api/v1/tags: the jz_bm_tags dictionary, to material managers
- POST /materials/{id}/unpublish: back to drafts, no revision bump, the
  search document resynced
- POST /materials/{id}/images: one JPEG/PNG/GIF/WebP per request through
  storeMaterialUpload, refusals with reason type, size or count
- storeMaterialUpload/fileRefusalFor: attach.ErrNotImage is a type
  refusal, not a 500; storeMaterialFile keeps its texts
- the author's routes get their own per-user buckets (the inline
  throttle form shares one counter per user)
- README: the author routes and revision on the student detail

plugin_test.go

@@ -148,6 +148,9 @@ func TestRoutes(t *testing.T) {
 		"GET /_bm/api/v1/materials/{id}/access",
 		"PUT /_bm/api/v1/materials/{id}/access",
 		"PUT /_bm/api/v1/materials/{id}",
+		"GET /_bm/api/v1/tags",
+		"POST /_bm/api/v1/materials/{id}/unpublish",
+		"POST /_bm/api/v1/materials/{id}/images",
 		"GET /_bm/api/v1/token/dashboard",
 		"GET /_bm/api/v1/token/courses",
 		"GET /_bm/api/v1/token/courses/{id}",