feat(feedback): in-app user feedback with admin review and account roles

User-facing Feedback screen (Settings -> Info, registered accounts only): a
message (<=1024 runes) plus one optional attachment, an anti-spam gate (one
unreviewed message at a time), and the operator's inline reply with a
Settings/Info badge. Server-rendered admin console section (/_gm/feedback):
unread/read/archived queue with per-user search, detail with read/reply/
archive/delete/delete-all, safe attachment serving (nosniff, images inline via
<img>, others download-only). Introduces account_roles, the first per-account
role table; feedback_banned blocks only feedback submission, granted/revoked
from /users and the delete-with-block action.

- migration 00004_feedback (feedback_messages + account_roles) + jetgen
- backend internal/feedback (store+service), internal/account/roles.go
- wire: FlatBuffers feedback.submit/get/unread; gateway guest gate (Op.NonGuest,
  is_guest via session resolve) -> guest_forbidden before any backend call
- reply push reuses NotificationEvent with a new admin_reply sub-kind
- UI: /feedback route + screen, attachment picker, badge, channel detection, i18n
- tests: feedback unit (Go+UI), gateway guest-gate, inttest lifecycle, e2e
- docs: PLAN stage 19, ARCHITECTURE s15, FUNCTIONAL(+ru), TESTING, READMEs

gateway/internal/connectsrv/server.go

@@ -207,11 +207,20 @@ func (s *Server) Execute(ctx context.Context, req *connect.Request[edgev1.Execut
 
 	tr := transcode.Request{Payload: req.Msg.GetPayload(), ClientIP: clientIP}
 	if op.Auth {
-		uid, err := s.resolve(ctx, req.Header())
+		uid, isGuest, err := s.resolve(ctx, req.Header())
 		if err != nil {
 			result = "unauthenticated"
 			return nil, err
 		}
+		// A guest may not perform a non-guest operation: reject it here as a domain
+		// outcome, before any backend call.
+		if op.NonGuest && isGuest {
+			result = "domain"
+			return connect.NewResponse(&edgev1.ExecuteResponse{
+				RequestId:  req.Msg.GetRequestId(),
+				ResultCode: "guest_forbidden",
+			}), nil
+		}
 		// A valid session proving an authenticated request is an "action" for the
 		// active_users gauge, counted before the rate-limit/domain outcome.
 		s.metrics.recordActive(uid)
@@ -254,7 +263,7 @@ func (s *Server) Execute(ctx context.Context, req *connect.Request[edgev1.Execut
 // Subscribe streams the authenticated user's live events with a keep-alive
 // heartbeat until the client disconnects.
 func (s *Server) Subscribe(ctx context.Context, req *connect.Request[edgev1.SubscribeRequest], stream *connect.ServerStream[edgev1.Event]) error {
-	uid, err := s.resolve(ctx, req.Header())
+	uid, _, err := s.resolve(ctx, req.Header())
 	if err != nil {
 		return err
 	}
@@ -332,14 +341,15 @@ func (s *Server) limitAdmin(next http.Handler) http.Handler {
 	})
 }
 
-// resolve extracts and resolves the Authorization bearer token to an account id,
-// returning a Connect Unauthenticated error when it is missing or unknown.
-func (s *Server) resolve(ctx context.Context, h http.Header) (string, error) {
+// resolve extracts and resolves the Authorization bearer token to an account id
+// and its guest flag, returning a Connect Unauthenticated error when it is missing
+// or unknown.
+func (s *Server) resolve(ctx context.Context, h http.Header) (string, bool, error) {
 	token := bearerToken(h.Get("Authorization"))
 	if token == "" {
-		return "", connect.NewError(connect.CodeUnauthenticated, errMissingToken)
+		return "", false, connect.NewError(connect.CodeUnauthenticated, errMissingToken)
 	}
-	uid, err := s.sessions.Resolve(ctx, token)
+	uid, isGuest, err := s.sessions.Resolve(ctx, token)
 	if err != nil {
 		// An unknown or expired token (a backend 4xx) is the client's problem and
 		// stays silent; anything else — a resolve timeout, a refused connection, a
@@ -350,9 +360,9 @@ func (s *Server) resolve(ctx context.Context, h http.Header) (string, error) {
 		if !errors.As(err, &apiErr) || apiErr.Status >= http.StatusInternalServerError {
 			s.log.Warn("session resolve failed", zap.Error(err))
 		}
-		return "", connect.NewError(connect.CodeUnauthenticated, errInvalidSession)
+		return "", false, connect.NewError(connect.CodeUnauthenticated, errInvalidSession)
 	}
-	return uid, nil
+	return uid, isGuest, nil
 }
 
 // bearerToken extracts the token from an "Authorization: Bearer <token>" header,

gateway/internal/connectsrv/server_test.go

@@ -69,6 +69,45 @@ func TestExecuteGuestAuthOK(t *testing.T) {
 	}
 }
 
+// TestExecuteGuestGate verifies the NonGuest op flag: a guest is rejected with the
+// guest_forbidden result code before any backend call, while a guest may still run
+// an authenticated op that is not guest-gated.
+func TestExecuteGuestGate(t *testing.T) {
+	client, cleanup := newEdge(t, func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/v1/internal/sessions/resolve":
+			_, _ = w.Write([]byte(`{"user_id":"g-1","is_guest":true}`))
+		case "/api/v1/user/feedback/unread":
+			_, _ = w.Write([]byte(`{"reply_unread":false}`))
+		case "/api/v1/user/feedback":
+			t.Errorf("guest feedback.submit must not reach the backend")
+		default:
+			t.Errorf("unexpected backend path %s", r.URL.Path)
+		}
+	})
+	defer cleanup()
+
+	submit := connect.NewRequest(&edgev1.ExecuteRequest{MessageType: transcode.MsgFeedbackSubmit, RequestId: "rq-1"})
+	submit.Header().Set("Authorization", "Bearer tok")
+	resp, err := client.Execute(context.Background(), submit)
+	if err != nil {
+		t.Fatalf("execute submit: %v", err)
+	}
+	if resp.Msg.GetResultCode() != "guest_forbidden" {
+		t.Fatalf("submit result = %q, want guest_forbidden", resp.Msg.GetResultCode())
+	}
+
+	unread := connect.NewRequest(&edgev1.ExecuteRequest{MessageType: transcode.MsgFeedbackUnread})
+	unread.Header().Set("Authorization", "Bearer tok")
+	resp, err = client.Execute(context.Background(), unread)
+	if err != nil {
+		t.Fatalf("execute unread: %v", err)
+	}
+	if resp.Msg.GetResultCode() != "ok" {
+		t.Fatalf("unread result = %q, want ok", resp.Msg.GetResultCode())
+	}
+}
+
 func TestExecuteAuthedRequiresSession(t *testing.T) {
 	client, cleanup := newEdge(t, func(w http.ResponseWriter, r *http.Request) {
 		t.Error("backend must not be called without a session")