feat: round-trip QTI AssessmentItem raw_data through save and sync

[rtibblesbot]

Summary

Extends AssessmentItem to store and round-trip an editor-authored QTI item's full XML in raw_data (type='QTI'), rather than the structured question/answers/hints fields legacy types use.

• Adds QTI as a valid AssessmentItem.type
• Persists raw_data verbatim (no whitespace trimming) and skips the legacy answers/hints JSON-shape coercion for QTI items
• Validates raw_data against the QTI 3.0 schema during sync save, rejecting invalid XML per-item through the existing sync error channel
• Extracts src/srcset/href/data checksum references from the QTI XML and wires them into the existing set_files claim/create/delete flow (mirrors the markdown-scan path legacy types already use)
• Rejects edits that mix the two field sets: a QTI item cannot edit question/answers/hints, and a non-QTI item cannot edit raw_data

Scoped to the sync API save path only, per the issue — ricecooker/internal API and QTI export/publish are unaffected.

References

Fixes #5999
Related: #5970 (QTI editor), #4877 (existing type validation)

Reviewer guidance

• contentcuration/contentcuration/viewsets/assessmentitem.py: validate() raises from within is_valid() (not create()/update()) specifically so a QTI schema error attributes to one item in the sync error channel instead of tripping the batch's broad except Exception — worth confirming that reasoning holds
• get_filenames_from_qti_item parses raw_data with the QTI validator's existing secure_parser() (XXE/entity-expansion hardened) — reused rather than re-implemented
• validate() now also rejects cross-type field edits (QTI item touching question/answers/hints, or non-QTI item touching raw_data), per review feedback asking to close that gap
• test_qti_assessmentitem_full_round_trip covers byte-for-byte round-trip on create/update plus file extraction/removal
• Full backend suite passes (no regressions)
• 3 pre-existing FileThumbnailTestCase failures on unstable are unrelated to this change (reproduced against unmodified unstable)

AI usage

Implemented with Claude Code from a maintainer-approved plan, using TDD per task. Wiring up schema validation broke an earlier whitespace round-trip test — the test padded raw_data with leading whitespace, which placed content before the XML declaration and is itself invalid XML. Fixed the test to pad trailing whitespace only, which still exercises trim_whitespace=False without producing invalid input.

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

• Ran pre-flight CI checks (lint, format, tests) and verified all pass
• Rebased onto the target branch and resolved any conflicts
• Reorganized commit history into clean, logical commits
• Audited the diff to ensure only issue-relevant files are changed
• Built PR body from the repository's PR template with evidence blocks

Status: 🟡 Waiting for feedback · updated 2026-07-03 16:16 UTC

[rtibbles]

Need to do the QTI constant properly - upgrade to le-utils 0.2.18.

[rtibbles]

Looking good - just one final thought about strengthening the validation - assessments have two paths, the QTI + raw_data path, or the other.

[rtibbles]

Excellent!