feat: personal pins on materials

A per-user jz_bm_material_pins table and PUT/DELETE /materials/{id}/pin
on the student API and its token twins: 204 for a material the caller
may see, idempotent, 404 otherwise. List rows, course rows and the
detail carry pinned. The plain list lists the caller's pins first
(newest pin first); with q the relevance order stays. A pin writes only
the pins table and never changes the material's revision.

controllers/api/json.go

@@ -213,6 +213,8 @@ type materialListJSON struct {
 	Tags        []tagJSON  `json:"tags"`
 	FilesCount  int64      `json:"files_count"`
 	IsPrivate   bool       `json:"is_private"`
+	// Pinned is the caller's own pin; nobody else sees it.
+	Pinned bool `json:"pinned"`
 	// Snippet is the matched passage of a search result (*snippetJSON, or
 	// a plain string through MCP). It is nil, and the key absent, without
 	// q or without a highlight.