feat(feedback): in-app user feedback with admin review and account roles

User-facing Feedback screen (Settings -> Info, registered accounts only): a
message (<=1024 runes) plus one optional attachment, an anti-spam gate (one
unreviewed message at a time), and the operator's inline reply with a
Settings/Info badge. Server-rendered admin console section (/_gm/feedback):
unread/read/archived queue with per-user search, detail with read/reply/
archive/delete/delete-all, safe attachment serving (nosniff, images inline via
<img>, others download-only). Introduces account_roles, the first per-account
role table; feedback_banned blocks only feedback submission, granted/revoked
from /users and the delete-with-block action.

- migration 00004_feedback (feedback_messages + account_roles) + jetgen
- backend internal/feedback (store+service), internal/account/roles.go
- wire: FlatBuffers feedback.submit/get/unread; gateway guest gate (Op.NonGuest,
  is_guest via session resolve) -> guest_forbidden before any backend call
- reply push reuses NotificationEvent with a new admin_reply sub-kind
- UI: /feedback route + screen, attachment picker, badge, channel detection, i18n
- tests: feedback unit (Go+UI), gateway guest-gate, inttest lifecycle, e2e
- docs: PLAN stage 19, ARCHITECTURE s15, FUNCTIONAL(+ru), TESTING, READMEs

gateway/internal/connectsrv/server.go

@@ -207,11 +207,20 @@ func (s *Server) Execute(ctx context.Context, req *connect.Request[edgev1.Execut
 
 	tr := transcode.Request{Payload: req.Msg.GetPayload(), ClientIP: clientIP}
 	if op.Auth {
-		uid, err := s.resolve(ctx, req.Header())
+		uid, isGuest, err := s.resolve(ctx, req.Header())
 		if err != nil {
 			result = "unauthenticated"
 			return nil, err
 		}
+		// A guest may not perform a non-guest operation: reject it here as a domain
+		// outcome, before any backend call.
+		if op.NonGuest && isGuest {
+			result = "domain"
+			return connect.NewResponse(&edgev1.ExecuteResponse{
+				RequestId:  req.Msg.GetRequestId(),
+				ResultCode: "guest_forbidden",
+			}), nil
+		}
 		// A valid session proving an authenticated request is an "action" for the
 		// active_users gauge, counted before the rate-limit/domain outcome.
 		s.metrics.recordActive(uid)
@@ -254,7 +263,7 @@ func (s *Server) Execute(ctx context.Context, req *connect.Request[edgev1.Execut
 // Subscribe streams the authenticated user's live events with a keep-alive
 // heartbeat until the client disconnects.
 func (s *Server) Subscribe(ctx context.Context, req *connect.Request[edgev1.SubscribeRequest], stream *connect.ServerStream[edgev1.Event]) error {
-	uid, err := s.resolve(ctx, req.Header())
+	uid, _, err := s.resolve(ctx, req.Header())
 	if err != nil {
 		return err
 	}
@@ -332,14 +341,15 @@ func (s *Server) limitAdmin(next http.Handler) http.Handler {
 	})
 }
 
-// resolve extracts and resolves the Authorization bearer token to an account id,
-// returning a Connect Unauthenticated error when it is missing or unknown.
-func (s *Server) resolve(ctx context.Context, h http.Header) (string, error) {
+// resolve extracts and resolves the Authorization bearer token to an account id
+// and its guest flag, returning a Connect Unauthenticated error when it is missing
+// or unknown.
+func (s *Server) resolve(ctx context.Context, h http.Header) (string, bool, error) {
 	token := bearerToken(h.Get("Authorization"))
 	if token == "" {
-		return "", connect.NewError(connect.CodeUnauthenticated, errMissingToken)
+		return "", false, connect.NewError(connect.CodeUnauthenticated, errMissingToken)
 	}
-	uid, err := s.sessions.Resolve(ctx, token)
+	uid, isGuest, err := s.sessions.Resolve(ctx, token)
 	if err != nil {
 		// An unknown or expired token (a backend 4xx) is the client's problem and
 		// stays silent; anything else — a resolve timeout, a refused connection, a
@@ -350,9 +360,9 @@ func (s *Server) resolve(ctx context.Context, h http.Header) (string, error) {
 		if !errors.As(err, &apiErr) || apiErr.Status >= http.StatusInternalServerError {
 			s.log.Warn("session resolve failed", zap.Error(err))
 		}
-		return "", connect.NewError(connect.CodeUnauthenticated, errInvalidSession)
+		return "", false, connect.NewError(connect.CodeUnauthenticated, errInvalidSession)
 	}
-	return uid, nil
+	return uid, isGuest, nil
 }
 
 // bearerToken extracts the token from an "Authorization: Bearer <token>" header,