feat(feedback): in-app user feedback with admin review and account roles

User-facing Feedback screen (Settings -> Info, registered accounts only): a
message (<=1024 runes) plus one optional attachment, an anti-spam gate (one
unreviewed message at a time), and the operator's inline reply with a
Settings/Info badge. Server-rendered admin console section (/_gm/feedback):
unread/read/archived queue with per-user search, detail with read/reply/
archive/delete/delete-all, safe attachment serving (nosniff, images inline via
<img>, others download-only). Introduces account_roles, the first per-account
role table; feedback_banned blocks only feedback submission, granted/revoked
from /users and the delete-with-block action.

- migration 00004_feedback (feedback_messages + account_roles) + jetgen
- backend internal/feedback (store+service), internal/account/roles.go
- wire: FlatBuffers feedback.submit/get/unread; gateway guest gate (Op.NonGuest,
  is_guest via session resolve) -> guest_forbidden before any backend call
- reply push reuses NotificationEvent with a new admin_reply sub-kind
- UI: /feedback route + screen, attachment picker, badge, channel detection, i18n
- tests: feedback unit (Go+UI), gateway guest-gate, inttest lifecycle, e2e
- docs: PLAN stage 19, ARCHITECTURE s15, FUNCTIONAL(+ru), TESTING, READMEs

ui/src/lib/codec.ts

@@ -12,6 +12,7 @@ import type {
   BlockStatus,
   ChatMessage,
   EvalResult,
+  FeedbackState,
   FriendCode,
   GameList,
   GameView,
@@ -437,6 +438,39 @@ export function decodeChatList(buf: Uint8Array): ChatMessage[] {
   return out;
 }
 
+export function encodeFeedbackSubmit(
+  body: string,
+  attachment: Uint8Array | null,
+  attachmentName: string,
+  channel: string,
+): Uint8Array {
+  const b = new Builder(256);
+  const bodyOff = b.createString(body);
+  const attOff = attachment && attachment.length > 0 ? fb.FeedbackSubmitRequest.createAttachmentVector(b, attachment) : 0;
+  const nameOff = b.createString(attachmentName);
+  const chOff = b.createString(channel);
+  fb.FeedbackSubmitRequest.startFeedbackSubmitRequest(b);
+  fb.FeedbackSubmitRequest.addBody(b, bodyOff);
+  if (attOff) fb.FeedbackSubmitRequest.addAttachment(b, attOff);
+  fb.FeedbackSubmitRequest.addAttachmentName(b, nameOff);
+  fb.FeedbackSubmitRequest.addChannel(b, chOff);
+  return finish(b, fb.FeedbackSubmitRequest.endFeedbackSubmitRequest(b));
+}
+
+export function decodeFeedbackState(buf: Uint8Array): FeedbackState {
+  const st = fb.FeedbackState.getRootAsFeedbackState(new ByteBuffer(buf));
+  const r = st.reply();
+  return {
+    canSend: st.canSend(),
+    blockedReason: s(st.blockedReason()),
+    reply: r ? { body: s(r.body()), repliedAtUnix: Number(r.repliedAtUnix()) } : null,
+  };
+}
+
+export function decodeFeedbackUnread(buf: Uint8Array): boolean {
+  return fb.FeedbackUnread.getRootAsFeedbackUnread(new ByteBuffer(buf)).replyUnread();
+}
+
 export function decodeEvent(kind: string, payload: Uint8Array): PushEvent | null {
   const bb = new ByteBuffer(payload);
   switch (kind) {