feat: attach material files over MCP as base64

- storeMaterialFile: the one attach.Store call of the management API,
  shared by the multipart route and the new inline route
- POST /api/v1/bm/materials/{id}/files/inline: JSON {name, mime?,
  content_base64}, at most 3000000 bytes decoded, body.limit 4300000
- bm_manage_attach_material_file and bm_manage_detach_material_file,
  both warning that material files are public to anyone with the link

plugin_test.go

@@ -139,6 +139,7 @@ func TestRoutes(t *testing.T) {
 		"PUT /api/v1/bm/materials/{id}",
 		"DELETE /api/v1/bm/materials/{id}",
 		"POST /api/v1/bm/materials/{id}/files",
+		"POST /api/v1/bm/materials/{id}/files/inline",
 		"DELETE /api/v1/bm/materials/{id}/files/{file}",
 		"GET /api/v1/bm/courses",
 		"GET /api/v1/bm/courses/{id}",