feat: personal pins on materials

A per-user jz_bm_material_pins table and PUT/DELETE /materials/{id}/pin
on the student API and its token twins: 204 for a material the caller
may see, idempotent, 404 otherwise. List rows, course rows and the
detail carry pinned. The plain list lists the caller's pins first
(newest pin first); with q the relevance order stays. A pin writes only
the pins table and never changes the material's revision.

controllers/api/material_search_test.go

@@ -233,6 +233,9 @@ func TestMaterialsSearchTrace(t *testing.T) {
 	if !strings.Contains(page, "array_position(ARRAY[9,3]::bigint[], jz_bm_materials.id)") {
 		t.Errorf("page query is not in rank order:\n%s", page)
 	}
+	if strings.Contains(page, "jz_bm_material_pins") {
+		t.Errorf("page query with q orders by pins, want the rank order only:\n%s", page)
+	}
 	var out struct {
 		Data []map[string]any `json:"data"`
 		Meta struct {