feat(feedback): in-app user feedback with admin review and account roles

User-facing Feedback screen (Settings -> Info, registered accounts only): a
message (<=1024 runes) plus one optional attachment, an anti-spam gate (one
unreviewed message at a time), and the operator's inline reply with a
Settings/Info badge. Server-rendered admin console section (/_gm/feedback):
unread/read/archived queue with per-user search, detail with read/reply/
archive/delete/delete-all, safe attachment serving (nosniff, images inline via
<img>, others download-only). Introduces account_roles, the first per-account
role table; feedback_banned blocks only feedback submission, granted/revoked
from /users and the delete-with-block action.

- migration 00004_feedback (feedback_messages + account_roles) + jetgen
- backend internal/feedback (store+service), internal/account/roles.go
- wire: FlatBuffers feedback.submit/get/unread; gateway guest gate (Op.NonGuest,
  is_guest via session resolve) -> guest_forbidden before any backend call
- reply push reuses NotificationEvent with a new admin_reply sub-kind
- UI: /feedback route + screen, attachment picker, badge, channel detection, i18n
- tests: feedback unit (Go+UI), gateway guest-gate, inttest lifecycle, e2e
- docs: PLAN stage 19, ARCHITECTURE s15, FUNCTIONAL(+ru), TESTING, READMEs

gateway/internal/session/cache_test.go

@@ -9,16 +9,17 @@ import (
 
 type fakeResolver struct {
 	uid   string
+	guest bool
 	err   error
 	calls int
 }
 
-func (f *fakeResolver) ResolveSession(_ context.Context, _ string) (string, error) {
+func (f *fakeResolver) ResolveSession(_ context.Context, _ string) (string, bool, error) {
 	f.calls++
 	if f.err != nil {
-		return "", f.err
+		return "", false, f.err
 	}
-	return f.uid, nil
+	return f.uid, f.guest, nil
 }
 
 func TestResolveCachesBackendHit(t *testing.T) {
@@ -26,7 +27,7 @@ func TestResolveCachesBackendHit(t *testing.T) {
 	c := NewCache(r, time.Minute, 10)
 
 	for i := 0; i < 3; i++ {
-		uid, err := c.Resolve(context.Background(), "tok")
+		uid, _, err := c.Resolve(context.Background(), "tok")
 		if err != nil || uid != "user-1" {
 			t.Fatalf("resolve #%d = (%q, %v)", i, uid, err)
 		}
@@ -36,10 +37,24 @@ func TestResolveCachesBackendHit(t *testing.T) {
 	}
 }
 
+func TestResolveCarriesAndCachesGuestFlag(t *testing.T) {
+	r := &fakeResolver{uid: "guest-1", guest: true}
+	c := NewCache(r, time.Minute, 10)
+	for i := 0; i < 2; i++ {
+		uid, guest, err := c.Resolve(context.Background(), "tok")
+		if err != nil || uid != "guest-1" || !guest {
+			t.Fatalf("resolve #%d = (%q, guest=%v, %v)", i, uid, guest, err)
+		}
+	}
+	if r.calls != 1 {
+		t.Fatalf("backend calls = %d, want 1 (guest flag cached)", r.calls)
+	}
+}
+
 func TestResolvePropagatesBackendError(t *testing.T) {
 	r := &fakeResolver{err: errors.New("nope")}
 	c := NewCache(r, time.Minute, 10)
-	if _, err := c.Resolve(context.Background(), "tok"); err == nil {
+	if _, _, err := c.Resolve(context.Background(), "tok"); err == nil {
 		t.Fatal("expected backend error to propagate")
 	}
 }
@@ -50,11 +65,11 @@ func TestResolveReResolvesAfterTTL(t *testing.T) {
 	base := time.Now()
 	c.now = func() time.Time { return base }
 
-	if _, err := c.Resolve(context.Background(), "tok"); err != nil {
+	if _, _, err := c.Resolve(context.Background(), "tok"); err != nil {
 		t.Fatal(err)
 	}
 	c.now = func() time.Time { return base.Add(2 * time.Minute) } // past TTL
-	if _, err := c.Resolve(context.Background(), "tok"); err != nil {
+	if _, _, err := c.Resolve(context.Background(), "tok"); err != nil {
 		t.Fatal(err)
 	}
 	if r.calls != 2 {
@@ -65,9 +80,9 @@ func TestResolveReResolvesAfterTTL(t *testing.T) {
 func TestInvalidateForcesReResolve(t *testing.T) {
 	r := &fakeResolver{uid: "user-1"}
 	c := NewCache(r, time.Minute, 10)
-	_, _ = c.Resolve(context.Background(), "tok")
+	_, _, _ = c.Resolve(context.Background(), "tok")
 	c.Invalidate("tok")
-	_, _ = c.Resolve(context.Background(), "tok")
+	_, _, _ = c.Resolve(context.Background(), "tok")
 	if r.calls != 2 {
 		t.Fatalf("backend calls = %d, want 2 after invalidate", r.calls)
 	}