The quests operator actions, for the ops plane.

POST /api/v1/ops/ext/quests/define

Defining a quest is an operator action, not a player one. It used to be exported and deliberately left off the manifest, because rpc/0 authenticates the caller as a player and there was no way to say "operator only" - the gap this repo filed as number 8. ops/0 is the answer: the action declares the config capability class, core resolves an operator identity and checks that class before this module runs, and core writes the audit row naming who asked.

The handler shape is the RPC one, unchanged, so there is nothing new to learn: (Params, Ctx) returning {ok, map()} | {error, Code} | {error, Code, Details}. Params is the decoded request body; Ctx carries the actor rather than a player.