feat(feedback): in-app user feedback with admin review and account roles

User-facing Feedback screen (Settings -> Info, registered accounts only): a
message (<=1024 runes) plus one optional attachment, an anti-spam gate (one
unreviewed message at a time), and the operator's inline reply with a
Settings/Info badge. Server-rendered admin console section (/_gm/feedback):
unread/read/archived queue with per-user search, detail with read/reply/
archive/delete/delete-all, safe attachment serving (nosniff, images inline via
<img>, others download-only). Introduces account_roles, the first per-account
role table; feedback_banned blocks only feedback submission, granted/revoked
from /users and the delete-with-block action.

- migration 00004_feedback (feedback_messages + account_roles) + jetgen
- backend internal/feedback (store+service), internal/account/roles.go
- wire: FlatBuffers feedback.submit/get/unread; gateway guest gate (Op.NonGuest,
  is_guest via session resolve) -> guest_forbidden before any backend call
- reply push reuses NotificationEvent with a new admin_reply sub-kind
- UI: /feedback route + screen, attachment picker, badge, channel detection, i18n
- tests: feedback unit (Go+UI), gateway guest-gate, inttest lifecycle, e2e
- docs: PLAN stage 19, ARCHITECTURE s15, FUNCTIONAL(+ru), TESTING, READMEs

ui/e2e/feedback.spec.ts

@@ -0,0 +1,45 @@
+import { expect, test, type Page } from './fixtures';
+
+// User feedback against the mock transport (no backend). The mock profile is a
+// durable (non-guest) account, so the Settings → Info "Feedback" entry is shown.
+
+async function loginLobby(page: Page): Promise<void> {
+  await page.goto('/');
+  await page.getByRole('button', { name: /guest/i }).click();
+  await expect(page.getByText('Your turn')).toBeVisible();
+}
+
+// openFeedback navigates lobby ⚙️ → Info tab → the Feedback screen.
+async function openFeedback(page: Page): Promise<void> {
+  await page.getByRole('button', { name: /Settings/ }).click();
+  await expect(page.locator('.pane')).toHaveCount(1);
+  await page.getByRole('button', { name: 'Info', exact: true }).click();
+  await page.getByRole('button', { name: 'Feedback', exact: true }).click();
+}
+
+test('feedback: submit a message, then resend is blocked', async ({ page }) => {
+  await loginLobby(page);
+  await openFeedback(page);
+
+  await expect(page.getByPlaceholder(/Describe the problem/)).toBeVisible();
+  await page.locator('textarea').fill('The board does not render on my phone.');
+  await page.getByRole('button', { name: 'Send', exact: true }).click();
+
+  await expect(page.getByText('Your message has been sent.')).toBeVisible();
+  await expect(page.getByRole('button', { name: 'Send', exact: true })).toBeDisabled();
+});
+
+test('feedback: an operator reply raises the badge and shows on the screen', async ({ page }) => {
+  await loginLobby(page);
+
+  // Simulate the operator answering: clears any pending message, sets the reply and
+  // pushes the admin_reply live event.
+  await page.evaluate(() => (window as unknown as { __mock: { adminReply(): void } }).__mock.adminReply());
+
+  // The lobby ⚙️ badge folds the awaiting reply into its count.
+  await expect(page.getByRole('button', { name: /Settings/ }).locator('.badge')).toBeVisible();
+
+  await openFeedback(page);
+  await expect(page.getByText('Reply to your last message')).toBeVisible();
+  await expect(page.getByText(/looking into it/)).toBeVisible();
+});