feat: attach material files over MCP as base64

- storeMaterialFile: the one attach.Store call of the management API,
  shared by the multipart route and the new inline route
- POST /api/v1/bm/materials/{id}/files/inline: JSON {name, mime?,
  content_base64}, at most 3000000 bytes decoded, body.limit 4300000
- bm_manage_attach_material_file and bm_manage_detach_material_file,
  both warning that material files are public to anyone with the link

controllers/api/export_test.go

@@ -0,0 +1,4 @@
+package api
+
+// DecodeInline exposes decodeInline to the api_test package.
+var DecodeInline = decodeInline