Serve private question images like lesson media

Quiz images uploaded to private paths blocked student access; now rewritten to a secure endpoint that vouches file access to the question author.