Add an API endpoint to upsert Hide and Reveal checkpoints

[Elimpizza]

Stacked over: #10130
Stacked under:

Adds the h-side write path for Hide & Reveal checkpoints:

• POST /api/checkpoints (h/views/api/checkpoints.py). Accepts { authority_provided_id, document_url, reveal_date } and upserts a checkpoint. Restricted to the LMS auth-client via a new Permission.API.CHECKPOINT_UPSERT (same predicate as the
  bulk API).
• CheckpointService.upsert(...). Resolves the group by (authority, authority_provided_id), find-or-creates the Document
  from its URL, then upserts the root checkpoint for (group_id, document_id, previous_checkpoint_id=NULL), overwriting
  reveal_date.
• Request schema (h/schemas/api/checkpoint.py), route, and a GroupNotFoundError -> 404 mapping.