Add a review-flag state for questions, independent of publish status

Flagged questions disappear from every student-facing surface (search,
exam simulation sampling, the missed-question review queue, bookmarks,
direct fetch) while staying published - flagging and unpublishing are
now separate, reversible actions with their own audit trail (who
flagged it, when, why). Backend-only for now: SUPER-only flag/unflag/
list endpoints, no client UI. Includes a one-time CLI sweep
(flag-media-questions) to flag every existing question with an image
so they can be reviewed.

api/QuestionsApi/Controllers/QuestionReportsController.cs

@@ -39,7 +39,7 @@ public class QuestionReportsController : ControllerBase
             return BadRequest($"details must be between {MinDetailsLength} and {MaxDetailsLength} characters");
 
         var question = await _questions.GetByExternalIdAsync(questionExternalId);
-        if (question is null || (!question.IsPublished && !User.IsInRole("SUPER")))
+        if (question is null || (!QuestionVisibility.IsVisibleToStudent(question.IsPublished, question.FlaggedForReviewUtc != null) && !User.IsInRole("SUPER")))
             return NotFound();
 
         var userId = CurrentUserId();