Update questions

Update up to BATCH_MAX_ITEMS questions (QUESTION FIELDS ONLY) in one request.

Answers are IMMUTABLE on update, so this edits the question's own fields only. A question is homed under a quiz XOR a question bank, so the write route accepts either quizzes:write OR question-banks:write (OR logic). The data array must contain at least one item and at most BATCH_MAX_ITEMS items. Each item carries the obfuscated question id and an attributes object with the fields to update, and is processed independently in its own atomic block — a failure on one row does not abort the rest. Response is 200 if all items succeed, 207 if any fail, 400 if the request envelope is empty or over the cap.

Read-only fields (question_type, quiz_id / question_bank_id, answers, order) are rejected with a document-level 422 via extra="forbid". A cross-state FLAG conflict against the stored question_type (e.g. case_sensitive on a stored MULTIPLE_CHOICE) surfaces as a per-item validation_error (207), not a 422.

Duplicate ids within one batch are NOT de-duplicated: each item is applied in order, so repeated ids are last-write-wins (the final item for that id wins, and each occurrence emits its own update event). This matches batch_update_students; per api_v2/docs/batch-responses.md within-batch dedup is the endpoint's choice and update endpoints accept last-write-wins rather than pre-marking duplicates.

See api_v2/docs/batch-responses.md for the 200/207/400 status convention and per-item error code vocabulary.

Required OAuth scope: question-banks:write or quizzes:write