Add a review-flag state for questions, independent of publish status

Flagged questions disappear from every student-facing surface (search,
exam simulation sampling, the missed-question review queue, bookmarks,
direct fetch) while staying published - flagging and unpublishing are
now separate, reversible actions with their own audit trail (who
flagged it, when, why). Backend-only for now: SUPER-only flag/unflag/
list endpoints, no client UI. Includes a one-time CLI sweep
(flag-media-questions) to flag every existing question with an image
so they can be reviewed.

api/QuestionsApi/Services/QuestionBookmarkStore.cs

@@ -105,7 +105,11 @@ public sealed class QuestionBookmarkStore
         }
 
         var questionMatch = new BsonDocument();
-        if (!includeUnpublished) questionMatch["Question.IsPublished"] = true;
+        if (!includeUnpublished)
+        {
+            questionMatch["Question.IsPublished"] = true;
+            questionMatch["Question.FlaggedForReviewUtc"] = BsonNull.Value;
+        }
         if (!string.IsNullOrWhiteSpace(system) && system != "All Systems") questionMatch["Question.System"] = system.Trim();
         if (!string.IsNullOrWhiteSpace(discipline)) questionMatch["Question.Discipline"] = discipline.Trim();
         if (!string.IsNullOrWhiteSpace(query))
@@ -172,7 +176,11 @@ public sealed class QuestionBookmarkStore
             new("$unwind", "$Question")
         };
         if (!includeUnpublished)
-            pipeline.Add(new BsonDocument("$match", new BsonDocument("Question.IsPublished", true)));
+            pipeline.Add(new BsonDocument("$match", new BsonDocument
+            {
+                { "Question.IsPublished", true },
+                { "Question.FlaggedForReviewUtc", BsonNull.Value }
+            }));
         pipeline.Add(new BsonDocument("$group", new BsonDocument
         {
             { "_id", BsonNull.Value },