feat: personal pins on materials

A per-user jz_bm_material_pins table and PUT/DELETE /materials/{id}/pin
on the student API and its token twins: 204 for a material the caller
may see, idempotent, 404 otherwise. List rows, course rows and the
detail carry pinned. The plain list lists the caller's pins first
(newest pin first); with q the relevance order stays. A pin writes only
the pins table and never changes the material's revision.

models/material_pin.go

@@ -0,0 +1,16 @@
+package models
+
+import "time"
+
+// MaterialPin is a personal pin: one row per material and user (a
+// golem15.user users row). Only that user sees it, and it lists the
+// material first on their own Materiały list.
+type MaterialPin struct {
+	ID         uint      `gorm:"column:id;primaryKey"`
+	MaterialID uint      `gorm:"column:material_id"`
+	UserID     uint      `gorm:"column:user_id"`
+	PinnedAt   time.Time `gorm:"column:pinned_at"`
+}
+
+// TableName is the plugin table.
+func (MaterialPin) TableName() string { return "jz_bm_material_pins" }