[paulyhedral]

Part of sweetrpg/platform#112

Summary

Implements group 2 (admin-api feedback endpoint) of the OpenSpec change add-anonymous-feedback-reporting (see openspec/changes/add-anonymous-feedback-reporting/ in sweetrpg/platform for proposal/design/spec/tasks).

• POST /feedback accepts type (bug|feature), title, body, optional reporter_email, optional source. Missing/invalid required fields -> 400.
• On acceptance, creates a GitHub Issue on sweetrpg/platform via a new feedback package wrapping google/go-github, labeled source:in-app-feedback plus bug/feature. Optional fields are appended to the issue body only when present.
• GitHub API failure/timeout -> 502, no internal retry (design.md: no persistence, GitHub Issue is the system of record).
• New feedback-specific Redis-backed rate-limit tier (bumped api-core.go to v0.3.1 for the ratelimit package), mounted only on this route - the service's existing global limiter and all other routes are unaffected.
• Title/body length caps (200/10000 chars) plus a honeypot field + minimum-fill-time check; submissions that fail either check return a normal success response without creating an issue, so a bot gets no signal.
• Swaggo annotations added; docs/swagger.{json,yaml} and docs/docs.go regenerated via this repo's documented swag init invocation.
• GITHUB_FEEDBACK_TOKEN env var read the same way this repo reads other secret-backed vars (envFrom.secretRef). Wired kubernetes/base/deployment.yaml's api-feedback secretRef to match. The ExternalSecret manifest itself (kubernetes/overlays/dev/secrets/feedback.yaml, pulling Akeyless path /sweetrpg/admin/api/feedback) still needs to be added by someone with access to that path - this session's sandbox hard-denies all read/write access to any **/secrets path, so kustomization.yaml does not yet reference it. Content needed:

  ---
  apiVersion: external-secrets.io/v1
  kind: ExternalSecret
  metadata:
      name: admin-api-feedback
  spec:
      refreshInterval: 1h
      secretStoreRef:
          name: akeyless
          kind: ClusterSecretStore
      target:
          name: api-feedback
          creationPolicy: Owner
      dataFrom:
          - extract:
                key: /sweetrpg/admin/api/feedback

  and add secrets/feedback.yaml to kubernetes/overlays/dev/kustomization.yaml's resources list.

Env var name for CORS/verification wiring elsewhere: GITHUB_FEEDBACK_TOKEN.

Known follow-up: admin-api had no Redis/cache instance

Before this change, admin-api had no Redis-backed anything (no cache, no per-client rate limiting) - the feedback endpoint's dedicated rate-limit tier needed one, so cmd/admin-api/main.go now builds a Redis pool (same pattern as game-room-api's setupRedisPool) that is nil when REDIS_HOST isn't set. With no pool, feedback.RateLimitMiddleware fails closed - every POST /feedback gets a 503 - rather than running unlimited; this is the correct behavior per the platform's rate-limiting spec, not a bug to fix in this PR. A separate infra task needs to provision admin-api's Redis cache via support/infrastructure's per-service cache overlay pattern (REDIS_HOST/REDIS_PORT wired into this service's configmap) before /feedback works end-to-end in an environment that needs it live.

Test plan

• go build ./...
• go vet ./...
• go test ./... - covers: valid bug/feature submission creates issue with correct labels; missing/invalid type, title, body -> 400; oversized title/body -> 400; honeypot populated -> silent 200/no issue; too-fast submission -> silent 200/no issue; optional fields included in body when present, omitted when absent; GitHub API failure -> 502; feedback rate-limit tier 429s on its own budget (miniredis-backed) while an unrelated route stays unaffected
• golangci-lint run ./... - 0 issues
• kustomize build kubernetes/overlays/dev still succeeds
• End-to-end dev verification once the ExternalSecret and Redis cache land (manual submission creating a real labeled issue) - out of this PR's scope