feat: the author edits a material in the app

- PUT /_bm/api/v1/materials/{id} (jwt.auth only, no token twin): every
  key of the edit body required, revision checked on the row locked FOR
  UPDATE, 409 with the student detail of the server version
- editableMaterialForCaller: 404 for what the caller cannot see, 403 for
  what they see but may not manage
- tags from the dictionary only (at most 4), http(s) urls, the body
  normalised as bm-notatka push does; course, author and publication kept
- loadMaterialDetail shared by GET /materials/{id} and the edit answers

plugin_test.go

@@ -147,6 +147,7 @@ func TestRoutes(t *testing.T) {
 		"DELETE /_bm/api/v1/calendar-feed",
 		"GET /_bm/api/v1/materials/{id}/access",
 		"PUT /_bm/api/v1/materials/{id}/access",
+		"PUT /_bm/api/v1/materials/{id}",
 		"GET /_bm/api/v1/token/dashboard",
 		"GET /_bm/api/v1/token/courses",
 		"GET /_bm/api/v1/token/courses/{id}",