feat: add the student API under /_bm/api/v1

Dashboard, courses with counters, schedule, meetings, deadlines,
readings with per-user progress (mark and unmark) and paginated
published materials with tags and files, behind golem15.user's
jwt.auth. Responses are built field by field with Warsaw RFC 3339
timestamps; bad query parameters answer 422 in Laravel's shape.

config/config.yaml

@@ -1 +1,7 @@
-{}
+# Defaults for jz.bm, merged under the plugin ID: the application reads them
+# as jz.bm.<key> and can override them in its own config.
+
+# Default page size of GET /_bm/api/v1/materials (clamped to 1..100).
+materials_per_page: 20
+# Number of class sessions and deadlines on GET /_bm/api/v1/dashboard.
+dashboard_limit: 5