feat: MCP view of BM answers (absolute links, no material body by default)

- jz.bm.mcp-links on the token twins and the management API: under MCP,
  url and *_url strings starting with a single / get the app base
- material answers under MCP leave the body out unless include_body,
  marking it with body_omitted; write answers never echo it
- jz.bm.manage keys a dispatched call by user
- bm_materials and bm_material student tools
Plain HTTP answers are unchanged.

controllers/api/materials.go

@@ -124,7 +124,8 @@ func (h *Handlers) Materials(w http.ResponseWriter, r *http.Request) {
 }
 
 // Material answers GET /materials/{id}: one published material with its
-// body, tags and files. A draft or a future publication is a 404.
+// body, tags and files. A draft or a future publication is a 404. An MCP
+// call gets the body only with include_body (see materialView).
 func (h *Handlers) Material(w http.ResponseWriter, r *http.Request) {
 	if _, ok := h.caller(w, r); !ok {
 		return
@@ -169,7 +170,7 @@ func (h *Handlers) Material(w http.ResponseWriter, r *http.Request) {
 		out.Files = append(out.Files, fileJSON{ID: f.ID, URL: f.URL(), Name: f.FileName, Size: f.FileSize, Mime: f.ContentType})
 	}
 	out.FilesCount = int64(len(out.Files))
-	writeData(w, out)
+	writeData(w, materialView(out, viaMCP(r), includeBody(r)))
 }
 
 // publishedMaterialsOfCourse lists a course's published materials, newest