feat: attach material files over MCP as base64

- storeMaterialFile: the one attach.Store call of the management API,
  shared by the multipart route and the new inline route
- POST /api/v1/bm/materials/{id}/files/inline: JSON {name, mime?,
  content_base64}, at most 3000000 bytes decoded, body.limit 4300000
- bm_manage_attach_material_file and bm_manage_detach_material_file,
  both warning that material files are public to anyone with the link

mcp.go

@@ -12,5 +12,6 @@ var _ pact.HasMCP = (*Plugin)(nil)
 // signed-in user under golem15.user's "user" guard, and their titles and
 // descriptions are static text, never built from data.
 func (p *Plugin) MCP() pact.MCP {
-	return pact.MCP{Tools: append(studentTools(), manageTools()...)}
+	tools := append(studentTools(), manageTools()...)
+	return pact.MCP{Tools: append(tools, fileTools()...)}
 }