feat(feedback): in-app user feedback with admin review and account roles

User-facing Feedback screen (Settings -> Info, registered accounts only): a
message (<=1024 runes) plus one optional attachment, an anti-spam gate (one
unreviewed message at a time), and the operator's inline reply with a
Settings/Info badge. Server-rendered admin console section (/_gm/feedback):
unread/read/archived queue with per-user search, detail with read/reply/
archive/delete/delete-all, safe attachment serving (nosniff, images inline via
<img>, others download-only). Introduces account_roles, the first per-account
role table; feedback_banned blocks only feedback submission, granted/revoked
from /users and the delete-with-block action.

- migration 00004_feedback (feedback_messages + account_roles) + jetgen
- backend internal/feedback (store+service), internal/account/roles.go
- wire: FlatBuffers feedback.submit/get/unread; gateway guest gate (Op.NonGuest,
  is_guest via session resolve) -> guest_forbidden before any backend call
- reply push reuses NotificationEvent with a new admin_reply sub-kind
- UI: /feedback route + screen, attachment picker, badge, channel detection, i18n
- tests: feedback unit (Go+UI), gateway guest-gate, inttest lifecycle, e2e
- docs: PLAN stage 19, ARCHITECTURE s15, FUNCTIONAL(+ru), TESTING, READMEs

gateway/internal/transcode/transcode.go

@@ -43,6 +43,9 @@ const (
 	MsgDraftGet       = "draft.get"
 	MsgDraftSave      = "draft.save"
 	MsgGameHide       = "game.hide"
+	MsgFeedbackSubmit = "feedback.submit"
+	MsgFeedbackGet    = "feedback.get"
+	MsgFeedbackUnread = "feedback.unread"
 )
 
 // Request is one decoded Execute call.
@@ -62,6 +65,10 @@ type Op struct {
 	Auth bool
 	// Email marks the costly email-code path that gets a stricter rate sub-limit.
 	Email bool
+	// NonGuest marks an operation a guest account may not perform; the gateway
+	// rejects it with the guest_forbidden result code after resolving the session,
+	// before any backend call.
+	NonGuest bool
 }
 
 // Registry maps message types to their operations.
@@ -117,6 +124,9 @@ func NewRegistry(backend *backendclient.Client, tg TelegramValidator, defaultLan
 	r.ops[MsgDraftGet] = Op{Handler: getDraftHandler(backend), Auth: true}
 	r.ops[MsgDraftSave] = Op{Handler: saveDraftHandler(backend), Auth: true}
 	r.ops[MsgGameHide] = Op{Handler: hideGameHandler(backend), Auth: true}
+	r.ops[MsgFeedbackSubmit] = Op{Handler: feedbackSubmitHandler(backend), Auth: true, NonGuest: true}
+	r.ops[MsgFeedbackGet] = Op{Handler: feedbackGetHandler(backend), Auth: true}
+	r.ops[MsgFeedbackUnread] = Op{Handler: feedbackUnreadHandler(backend), Auth: true}
 	registerSocialOps(r, backend)
 	registerLinkOps(r, backend, tg, defaultLanguages)
 	return r
@@ -477,3 +487,33 @@ func hideGameHandler(backend *backendclient.Client) Handler {
 		return encodeAck(true), nil
 	}
 }
+
+func feedbackSubmitHandler(backend *backendclient.Client) Handler {
+	return func(ctx context.Context, req Request) ([]byte, error) {
+		in := fb.GetRootAsFeedbackSubmitRequest(req.Payload, 0)
+		if err := backend.FeedbackSubmit(ctx, req.UserID, string(in.Body()), in.AttachmentBytes(), string(in.AttachmentName()), string(in.Channel()), req.ClientIP); err != nil {
+			return nil, err
+		}
+		return encodeAck(true), nil
+	}
+}
+
+func feedbackGetHandler(backend *backendclient.Client) Handler {
+	return func(ctx context.Context, req Request) ([]byte, error) {
+		st, err := backend.FeedbackGet(ctx, req.UserID)
+		if err != nil {
+			return nil, err
+		}
+		return encodeFeedbackState(st), nil
+	}
+}
+
+func feedbackUnreadHandler(backend *backendclient.Client) Handler {
+	return func(ctx context.Context, req Request) ([]byte, error) {
+		u, err := backend.FeedbackUnread(ctx, req.UserID)
+		if err != nil {
+			return nil, err
+		}
+		return encodeFeedbackUnread(u), nil
+	}
+}