feat(feedback): in-app user feedback with admin review and account roles

User-facing Feedback screen (Settings -> Info, registered accounts only): a
message (<=1024 runes) plus one optional attachment, an anti-spam gate (one
unreviewed message at a time), and the operator's inline reply with a
Settings/Info badge. Server-rendered admin console section (/_gm/feedback):
unread/read/archived queue with per-user search, detail with read/reply/
archive/delete/delete-all, safe attachment serving (nosniff, images inline via
<img>, others download-only). Introduces account_roles, the first per-account
role table; feedback_banned blocks only feedback submission, granted/revoked
from /users and the delete-with-block action.

- migration 00004_feedback (feedback_messages + account_roles) + jetgen
- backend internal/feedback (store+service), internal/account/roles.go
- wire: FlatBuffers feedback.submit/get/unread; gateway guest gate (Op.NonGuest,
  is_guest via session resolve) -> guest_forbidden before any backend call
- reply push reuses NotificationEvent with a new admin_reply sub-kind
- UI: /feedback route + screen, attachment picker, badge, channel detection, i18n
- tests: feedback unit (Go+UI), gateway guest-gate, inttest lifecycle, e2e
- docs: PLAN stage 19, ARCHITECTURE s15, FUNCTIONAL(+ru), TESTING, READMEs

docs/TESTING.md

@@ -136,6 +136,15 @@ tests or touching CI.
   postgres_exporter** Grafana dashboard on the contour. Two passes are recorded — the
   early [`REPORT-R2.md`](../loadtest/REPORT-R2.md) and the final, tuned
   [`REPORT-R7.md`](../loadtest/REPORT-R7.md). See [`../loadtest/README.md`](../loadtest/README.md).
+- **User feedback** — `internal/feedback` unit tests cover the attachment allow-list /
+  content-type and the channel normaliser; the UI covers `detectChannel`, the attachment gate and
+  the feedback wire round-trip (`channel` / `feedback` / `codec` tests) plus a Playwright e2e
+  (submit → confirm + resend blocked; an operator reply raises the badge and shows on the screen).
+  The gateway `connectsrv` test asserts the **guest gate** (a guest's `feedback.submit` →
+  `guest_forbidden` with no backend call; a non-gated authenticated op still passes). Postgres-backed
+  `inttest` drives the **feedback lifecycle** end to end: the guest / ban / pending gates, the reply
+  read + one-week visibility window, the account-role grant/revoke, and the admin queue filters with
+  delete / delete-all. The admin-console render test renders the feedback list + detail pages.
 
 ## Principles