feat: per-response and general widget feedback

[neuromechanist]

Summary

Adds a feedback channel to the OSA chat widget and surfaces it to community admins.

• Widget: thumbs up/down under each assistant reply (sentiment only, one-vote-lock, keyed to a new per-response request_id) plus a Send-feedback footer link opening a free-text modal for general feedback.
• Backend: anonymous POST /feedback (the Cloudflare worker already proxies to it) writing to a new feedback_log table in the existing metrics.db (auto-created via CREATE TABLE IF NOT EXISTS; rides the osa-data volume). request_id is exposed on the chat/ask done event and ChatResponse/AskResponse. page_url is scheme-validated to prevent stored XSS in the admin view.
• Admin: GET /metrics/feedback (per-community scoped key, strictly confined) and a Feedback panel on the status dashboard.

Closes #282

Test plan

• 23 new tests (feedback_log table + write_feedback + summary/entries queries; POST /feedback validation and GET /metrics/feedback scoping). No mocks.
• ruff clean; widget JS node --check valid; full api+metrics suite green (the only 2 failing tests in the repo are pre-existing .env-contamination failures, unrelated).

[github-actions]

Preview Deployment

Name	Link
Preview URL	https://feature-issue-282-per-respon-demo.osc.earth
Branch	feature/issue-282-per-response-feedback
Commit	26840b5

This preview will be updated automatically when you push new commits.

[github-actions]

Dashboard Preview

Name	Link
Preview URL	https://feature-issue-282-per-respon.osa-dash.pages.dev
Branch	feature/issue-282-per-response-feedback
Commit	26840b5

This preview will be updated automatically when you push new commits.

[neuromechanist]

PR review (pr-review-toolkit, 5 agents, sonnet) — findings addressed in c1d823c

Correctness / security

• write_feedback had a dead try/except sqlite3.Error in the router (it never raises) — removed; write_feedback now also acquires its connection inside the try so it honors its never-raises contract. Misleading comment fixed.
• Storage-layer invariants: FeedbackEntry narrowed to Literal types + __post_init__ rejecting illegal shapes (e.g. a response with no sentiment); added SQLite CHECK constraints + a UNIQUE index on feedback_id.
• object.__setattr__ in the validator replaced with an idiomatic mode="before" normalizer; removed the now-unreachable manual whitelist checks.
• Silent vote-drop: submitResponseFeedback now awaits the POST and rolls back the optimistic vote (with an error) on failure.

Tests (no mocks)

• Replaced the unittest.mock.patch fixture with a DATA_DIR env fixture.
• Added: __post_init__ invariant tests, write-failure counter + CRITICAL escalation, comments_only/offset/limit-floor, data:/ftp: page_url rejection, general-sentiment-stripping, request_id round-trip, cross-community admin aggregation; fixed the no-op test_limit_clamped. 38 feedback tests pass; 468 in the broader suite (1 pre-existing .env-contamination failure, unrelated).

Docs/comments: db module docstring, warning SSE event, request_id wording, widget/dashboard comment + error-message fixes.

Skipped (by design, noted): discriminated-union split for FeedbackRequest (the __post_init__ + Literal + CHECK trio gives the safety with less complexity); module-global failure-counter refactor (pre-existing pattern shared with log_request; tests reset it); redundant community_id echoed in the summary dict (intentional parallel with get_community_summary).