feat(feedback): in-app user feedback with admin review and account roles

User-facing Feedback screen (Settings -> Info, registered accounts only): a
message (<=1024 runes) plus one optional attachment, an anti-spam gate (one
unreviewed message at a time), and the operator's inline reply with a
Settings/Info badge. Server-rendered admin console section (/_gm/feedback):
unread/read/archived queue with per-user search, detail with read/reply/
archive/delete/delete-all, safe attachment serving (nosniff, images inline via
<img>, others download-only). Introduces account_roles, the first per-account
role table; feedback_banned blocks only feedback submission, granted/revoked
from /users and the delete-with-block action.

- migration 00004_feedback (feedback_messages + account_roles) + jetgen
- backend internal/feedback (store+service), internal/account/roles.go
- wire: FlatBuffers feedback.submit/get/unread; gateway guest gate (Op.NonGuest,
  is_guest via session resolve) -> guest_forbidden before any backend call
- reply push reuses NotificationEvent with a new admin_reply sub-kind
- UI: /feedback route + screen, attachment picker, badge, channel detection, i18n
- tests: feedback unit (Go+UI), gateway guest-gate, inttest lifecycle, e2e
- docs: PLAN stage 19, ARCHITECTURE s15, FUNCTIONAL(+ru), TESTING, READMEs

docs/UI_DESIGN.md

@@ -33,7 +33,9 @@ Login uses `Screen`.
   hub tabs: ⚙️ Settings / 👤 Profile / 🤝 Friends / ℹ️ About (Friends hidden for guests);
   comms hub tabs: 💬 Chat / 🔎 Dictionary (Dictionary only while the game is active). The
   routes `/settings|/profile|/friends|/about` and `/game/:id/{chat,check}` survive as hub
-  entry points (so a Telegram friend-code deep-link still lands on the Friends tab).
+  entry points (so a Telegram friend-code deep-link still lands on the Friends tab). The
+  **Feedback** screen is its own deeper route `/feedback` (back → `/about`, the Info tab), so
+  it slides in/out like a sub-screen rather than switching a tab in place.
 - **Tab bar** (`TabBar.svelte`): square, borderless, evenly distributed buttons — a large
   emoji icon over a tiny truncated label (the icon is `aria-hidden`, so the label names the
   button). A press highlights a rounded **square** behind the icon; a hub's **selected** tab
@@ -252,6 +254,14 @@ IV 🏅; active games show Your move 🟢 / Opponent's move ⏳; invitations use
   row is turn-driven: on your turn the message field shows until your one allowed message is
   sent, then a short caption replaces it until the next turn; on the opponent's turn the 🛎️
   nudge takes the field's place.
+- **Feedback** (`screens/Feedback.svelte`, reached from a button at the bottom of the ℹ️ Info
+  tab, registered accounts only): a multi-line message field over a row that pairs a **ghost**
+  attach button (a hidden `<input type=file>`, with a chosen-file name + a remove control) with
+  the filled accent **Send** button. A rejected file shows one generic notice (the allowed types
+  are not advertised). The send controls disable while a previous message is under review or the
+  account is barred; the operator's reply renders below as a titled block. An undelivered reply
+  raises a badge on the lobby ⚙️ tab (combined with the friend-request count) and a "1" on the
+  Info tab.
 
 ## Caveat