Add a review-flag state for questions, independent of publish status

Flagged questions disappear from every student-facing surface (search,
exam simulation sampling, the missed-question review queue, bookmarks,
direct fetch) while staying published - flagging and unpublishing are
now separate, reversible actions with their own audit trail (who
flagged it, when, why). Backend-only for now: SUPER-only flag/unflag/
list endpoints, no client UI. Includes a one-time CLI sweep
(flag-media-questions) to flag every existing question with an image
so they can be reviewed.

api/QuestionsApi/Services/ReviewQueueStore.cs

@@ -129,7 +129,7 @@ public sealed class ReviewQueueStore
             foreach (var candidate in candidates)
             {
                 var question = await _questions.GetByExternalIdAsync(candidate.QuestionExternalId);
-                if (question is { IsPublished: true }) return candidate;
+                if (question is { IsPublished: true, FlaggedForReviewUtc: null }) return candidate;
                 await _items.UpdateOneAsync(
                     value => value.Id == candidate.Id && value.State == ReviewQueueStates.Pending,
                     Builders<ReviewQueueItem>.Update