feat(feedback): in-app user feedback with admin review and account roles

User-facing Feedback screen (Settings -> Info, registered accounts only): a
message (<=1024 runes) plus one optional attachment, an anti-spam gate (one
unreviewed message at a time), and the operator's inline reply with a
Settings/Info badge. Server-rendered admin console section (/_gm/feedback):
unread/read/archived queue with per-user search, detail with read/reply/
archive/delete/delete-all, safe attachment serving (nosniff, images inline via
<img>, others download-only). Introduces account_roles, the first per-account
role table; feedback_banned blocks only feedback submission, granted/revoked
from /users and the delete-with-block action.

- migration 00004_feedback (feedback_messages + account_roles) + jetgen
- backend internal/feedback (store+service), internal/account/roles.go
- wire: FlatBuffers feedback.submit/get/unread; gateway guest gate (Op.NonGuest,
  is_guest via session resolve) -> guest_forbidden before any backend call
- reply push reuses NotificationEvent with a new admin_reply sub-kind
- UI: /feedback route + screen, attachment picker, badge, channel detection, i18n
- tests: feedback unit (Go+UI), gateway guest-gate, inttest lifecycle, e2e
- docs: PLAN stage 19, ARCHITECTURE s15, FUNCTIONAL(+ru), TESTING, READMEs

gateway/internal/transcode/encode.go

@@ -324,6 +324,37 @@ func encodeChatList(r backendclient.ChatListResp) []byte {
 	return b.FinishedBytes()
 }
 
+// encodeFeedbackState builds a FeedbackState payload, nesting the reply when present.
+func encodeFeedbackState(st backendclient.FeedbackStateResp) []byte {
+	b := flatbuffers.NewBuilder(128)
+	var reply flatbuffers.UOffsetT
+	if st.Reply != nil {
+		body := b.CreateString(st.Reply.Body)
+		fb.FeedbackReplyStart(b)
+		fb.FeedbackReplyAddBody(b, body)
+		fb.FeedbackReplyAddRepliedAtUnix(b, st.Reply.RepliedAtUnix)
+		reply = fb.FeedbackReplyEnd(b)
+	}
+	reason := b.CreateString(st.BlockedReason)
+	fb.FeedbackStateStart(b)
+	fb.FeedbackStateAddCanSend(b, st.CanSend)
+	fb.FeedbackStateAddBlockedReason(b, reason)
+	if st.Reply != nil {
+		fb.FeedbackStateAddReply(b, reply)
+	}
+	b.Finish(fb.FeedbackStateEnd(b))
+	return b.FinishedBytes()
+}
+
+// encodeFeedbackUnread builds a FeedbackUnread payload.
+func encodeFeedbackUnread(u backendclient.FeedbackUnreadResp) []byte {
+	b := flatbuffers.NewBuilder(16)
+	fb.FeedbackUnreadStart(b)
+	fb.FeedbackUnreadAddReplyUnread(b, u.ReplyUnread)
+	b.Finish(fb.FeedbackUnreadEnd(b))
+	return b.FinishedBytes()
+}
+
 // buildGameView builds a GameView table and returns its offset.
 func buildGameView(b *flatbuffers.Builder, g backendclient.GameResp) flatbuffers.UOffsetT {
 	return wire.BuildGameView(b, toWireGame(g))

gateway/internal/transcode/transcode.go

@@ -43,6 +43,9 @@ const (
 	MsgDraftGet       = "draft.get"
 	MsgDraftSave      = "draft.save"
 	MsgGameHide       = "game.hide"
+	MsgFeedbackSubmit = "feedback.submit"
+	MsgFeedbackGet    = "feedback.get"
+	MsgFeedbackUnread = "feedback.unread"
 )
 
 // Request is one decoded Execute call.
@@ -62,6 +65,10 @@ type Op struct {
 	Auth bool
 	// Email marks the costly email-code path that gets a stricter rate sub-limit.
 	Email bool
+	// NonGuest marks an operation a guest account may not perform; the gateway
+	// rejects it with the guest_forbidden result code after resolving the session,
+	// before any backend call.
+	NonGuest bool
 }
 
 // Registry maps message types to their operations.
@@ -117,6 +124,9 @@ func NewRegistry(backend *backendclient.Client, tg TelegramValidator, defaultLan
 	r.ops[MsgDraftGet] = Op{Handler: getDraftHandler(backend), Auth: true}
 	r.ops[MsgDraftSave] = Op{Handler: saveDraftHandler(backend), Auth: true}
 	r.ops[MsgGameHide] = Op{Handler: hideGameHandler(backend), Auth: true}
+	r.ops[MsgFeedbackSubmit] = Op{Handler: feedbackSubmitHandler(backend), Auth: true, NonGuest: true}
+	r.ops[MsgFeedbackGet] = Op{Handler: feedbackGetHandler(backend), Auth: true}
+	r.ops[MsgFeedbackUnread] = Op{Handler: feedbackUnreadHandler(backend), Auth: true}
 	registerSocialOps(r, backend)
 	registerLinkOps(r, backend, tg, defaultLanguages)
 	return r
@@ -477,3 +487,33 @@ func hideGameHandler(backend *backendclient.Client) Handler {
 		return encodeAck(true), nil
 	}
 }
+
+func feedbackSubmitHandler(backend *backendclient.Client) Handler {
+	return func(ctx context.Context, req Request) ([]byte, error) {
+		in := fb.GetRootAsFeedbackSubmitRequest(req.Payload, 0)
+		if err := backend.FeedbackSubmit(ctx, req.UserID, string(in.Body()), in.AttachmentBytes(), string(in.AttachmentName()), string(in.Channel()), req.ClientIP); err != nil {
+			return nil, err
+		}
+		return encodeAck(true), nil
+	}
+}
+
+func feedbackGetHandler(backend *backendclient.Client) Handler {
+	return func(ctx context.Context, req Request) ([]byte, error) {
+		st, err := backend.FeedbackGet(ctx, req.UserID)
+		if err != nil {
+			return nil, err
+		}
+		return encodeFeedbackState(st), nil
+	}
+}
+
+func feedbackUnreadHandler(backend *backendclient.Client) Handler {
+	return func(ctx context.Context, req Request) ([]byte, error) {
+		u, err := backend.FeedbackUnread(ctx, req.UserID)
+		if err != nil {
+			return nil, err
+		}
+		return encodeFeedbackUnread(u), nil
+	}
+}