feat(feedback): in-app user feedback with admin review and account roles

User-facing Feedback screen (Settings -> Info, registered accounts only): a
message (<=1024 runes) plus one optional attachment, an anti-spam gate (one
unreviewed message at a time), and the operator's inline reply with a
Settings/Info badge. Server-rendered admin console section (/_gm/feedback):
unread/read/archived queue with per-user search, detail with read/reply/
archive/delete/delete-all, safe attachment serving (nosniff, images inline via
<img>, others download-only). Introduces account_roles, the first per-account
role table; feedback_banned blocks only feedback submission, granted/revoked
from /users and the delete-with-block action.

- migration 00004_feedback (feedback_messages + account_roles) + jetgen
- backend internal/feedback (store+service), internal/account/roles.go
- wire: FlatBuffers feedback.submit/get/unread; gateway guest gate (Op.NonGuest,
  is_guest via session resolve) -> guest_forbidden before any backend call
- reply push reuses NotificationEvent with a new admin_reply sub-kind
- UI: /feedback route + screen, attachment picker, badge, channel detection, i18n
- tests: feedback unit (Go+UI), gateway guest-gate, inttest lifecycle, e2e
- docs: PLAN stage 19, ARCHITECTURE s15, FUNCTIONAL(+ru), TESTING, READMEs

ui/src/lib/app.svelte.ts

@@ -59,6 +59,9 @@ export const app = $state<{
   notifications: number;
   /** Unread chat-message count per game id, for the in-game score-bar and 💬 badges. */
   chatUnread: Record<string, number>;
+  /** Whether an operator feedback reply awaits the player, for the lobby ⚙️ badge (combined
+   *  with friend requests) and the Settings → Info badge. */
+  feedbackReplyUnread: boolean;
   /** Monotonic counter bumped when the app returns to the foreground without the live stream
    *  having dropped. An open game watches it to refetch once, recovering an in-game event shed
    *  from a full hub buffer while suspended (the stream-drop case is covered by streamAlive). */
@@ -79,6 +82,7 @@ export const app = $state<{
   localeLocked: false,
   notifications: 0,
   chatUnread: {},
+  feedbackReplyUnread: false,
   resync: 0,
 });
 
@@ -257,6 +261,10 @@ function openStream(): void {
         if ((e.sub === 'invitation' || e.sub === 'invitation_update') && e.invitation) {
           patchLobbyInvitation(e.invitation);
         }
+        // An operator answered the player's feedback: raise the Settings/Info badge.
+        if (e.sub === 'admin_reply') {
+          app.feedbackReplyUnread = true;
+        }
         void refreshNotifications();
       }
     },
@@ -299,6 +307,24 @@ export async function refreshNotifications(): Promise<void> {
   }
 }
 
+/**
+ * refreshFeedbackBadge recomputes whether an operator feedback reply awaits the
+ * player (the Settings → Info badge, folded into the lobby ⚙️ badge). Authoritative
+ * poll, complementing the live 'admin_reply' push. Guests cannot submit feedback, so
+ * it is a no-op for them.
+ */
+export async function refreshFeedbackBadge(): Promise<void> {
+  if (!app.session || app.profile?.isGuest) {
+    app.feedbackReplyUnread = false;
+    return;
+  }
+  try {
+    app.feedbackReplyUnread = await gateway.feedbackUnread();
+  } catch {
+    // Best-effort; leave the previous flag on a transient failure.
+  }
+}
+
 function closeStream(): void {
   if (reconnectTimer) {
     clearTimeout(reconnectTimer);