Add variable question distractor pools

api/QuestionsApi/README.md

@@ -7,6 +7,7 @@ STEP-style question bank service for study games and clients.
 - `GET /healthz` Health check.
 - `GET /api/questions/systems` List available systems.
 - `POST /api/questions/search` Search or build a block of questions.
+- `GET /api/questions/admin/export` Cursor-paginated full-bank export (SUPER only).
 - `GET /api/questions/{id}` Get one question.
 - `POST /api/questions` Create question (SUPER only).
 - `POST /api/questions/bulk` Upsert questions by `externalId` (SUPER only).
@@ -22,10 +23,23 @@ Player reads require `USER` or `SUPER` JWT auth. Authoring endpoints require `SU
 ## Answer tracking
 
 The `QuestionAttempts` collection is the immutable source of truth and enforces
-one first attempt per question and user with a unique compound index. Choice
-percentages are served from 32-way materialized counter buckets and cached for
-up to five minutes. A background service backfills counters on the first deploy
-and reconciles recently active questions every five minutes.
+one first attempt per question and user with a unique compound index. Updated
+clients submit the five choice IDs that were presented. Choice rates are the
+percentage of presentations that resulted in selection, served from 32-way
+materialized counter buckets and cached for up to five minutes. These rates are
+independent and are not expected to sum to 100% when users see different
+distractor subsets.
+
+A background service snapshots the original choice IDs, backfills historical
+attempts into v2 exposure counters, and reconciles recently active questions
+every five minutes. The metric
+`step3_answer_statistics_v2_backfill_complete` must equal `1` before adding
+extra distractors to existing questions.
+
+Search clients that set `supportsChoicePools: true` receive each complete
+choice pool. Older clients receive five server-selected choices that always
+include the correct answer. Published questions require 5-20 unique choices,
+an explanation for every choice, and a follow-up for every incorrect choice.
 
 - `GET /readyz` verifies MongoDB connectivity for readiness checks.
 - `GET /metrics` exposes Prometheus-format service and reconciliation metrics.