feat(manage): GET and PUT /api/v1/bm/materials/{id}

The management API could only upsert a material on its title and course,
so a renamed note became a second material. PUT /materials/{id} applies the
same body to one material (422 when the new title and course belong to
another one), GET /materials/{id} shows a draft or published material with
its public files, and the upsert, update and validation share one path.
The README documents the management API.

plugin_test.go

@@ -120,7 +120,9 @@ func TestRoutes(t *testing.T) {
 		"GET /api/v1/bm/me",
 		"GET /api/v1/bm/courses",
 		"GET /api/v1/bm/materials",
+		"GET /api/v1/bm/materials/{id}",
 		"POST /api/v1/bm/materials",
+		"PUT /api/v1/bm/materials/{id}",
 		"DELETE /api/v1/bm/materials/{id}",
 		"POST /api/v1/bm/seed",
 	}