feat(feedback): in-app user feedback with admin review and account roles

User-facing Feedback screen (Settings -> Info, registered accounts only): a
message (<=1024 runes) plus one optional attachment, an anti-spam gate (one
unreviewed message at a time), and the operator's inline reply with a
Settings/Info badge. Server-rendered admin console section (/_gm/feedback):
unread/read/archived queue with per-user search, detail with read/reply/
archive/delete/delete-all, safe attachment serving (nosniff, images inline via
<img>, others download-only). Introduces account_roles, the first per-account
role table; feedback_banned blocks only feedback submission, granted/revoked
from /users and the delete-with-block action.

- migration 00004_feedback (feedback_messages + account_roles) + jetgen
- backend internal/feedback (store+service), internal/account/roles.go
- wire: FlatBuffers feedback.submit/get/unread; gateway guest gate (Op.NonGuest,
  is_guest via session resolve) -> guest_forbidden before any backend call
- reply push reuses NotificationEvent with a new admin_reply sub-kind
- UI: /feedback route + screen, attachment picker, badge, channel detection, i18n
- tests: feedback unit (Go+UI), gateway guest-gate, inttest lifecycle, e2e
- docs: PLAN stage 19, ARCHITECTURE s15, FUNCTIONAL(+ru), TESTING, READMEs

docs/FUNCTIONAL.md

@@ -172,6 +172,18 @@ block toggles. The profile form is edited inline (no separate edit mode). Linkin
 an email or Telegram and merging accounts are covered under "Accounts, linking &
 merge".
 
+### Feedback
+A registered player reaches the operators from Settings → Info: a **Feedback** screen with a
+message (up to 1024 characters) and an optional single attachment (one file, up to ~1 MB — images,
+PDF, text/log, office documents, RTF or archives; an unsupported file is refused on the form
+without naming the allowed types). After sending, the form clears and confirms "Ваше сообщение
+отправлено", and sending is blocked until the operator has dealt with that message — on re-entry
+the screen reads "Ожидаем рассмотрения вашего последнего обращения". The operator's reply appears
+below the form as "Ответ на ваше последнее сообщение"; it is marked read once the screen shows it
+and disappears a week later. A badge on the Settings tab (and on Info inside it) flags an
+unanswered reply. Guests cannot send feedback (the entry is hidden). A player the operator has
+barred from feedback (a role, not a full account block) sees the send control disabled.
+
 ### History & statistics
 Finished games are archived in a dictionary-independent form and exportable to
 GCG; the export is offered **only once a game is finished** (exporting a live game
@@ -225,3 +237,12 @@ From the user card the operator can also **top up a player's hint wallet**: an a
 (1–100 hints per action) that raises the balance shown on the card. Grants are **raise-only** —
 the console can never lower a wallet (a player only loses hints by spending them in a game), so an
 over-grant cannot be reversed there.
+
+The console works a **feedback** queue too (`/_gm/feedback`): the messages players sent, filtered
+**unread / read / archived** with per-user search, each shown with its sender, source, channel, IP
+and any attachment. The operator can mark a message read, **reply** to the player (delivered
+in-app), archive it, delete it, or delete every message from that player — and, alongside a delete,
+**bar the player from feedback** (a `feedback_banned` role, distinct from a full account block: it
+stops only feedback submission). Roles are listed and granted/revoked on the user card. Opening a
+message does not mark it read — only the explicit actions do; message bodies and attachments are
+shown defensively (text escaped, attachments downloaded rather than rendered).