feat: feedback submissions with screenshots, the hide-widget preference and its user payload key

- POST /_feedback/api/v1/{key}/submit validates as PHP, refuses non-image screenshots (ImageContentGuard copy) and stores the submission, its public screenshot and the G15Office job in one transaction
- PUT /_feedback/api/v1/me/hidden (jwt.auth) stores the caller's preference; feedback_widget_hidden joins every golem15.user payload
- preflights stay with the framework CORS layer

go.mod

@@ -7,6 +7,7 @@ require (
 	git.golem15.com/golem15/summercms v0.0.0
 	github.com/go-gormigrate/gormigrate/v2 v2.1.7
 	github.com/testcontainers/testcontainers-go/modules/postgres v0.44.0
+	gocloud.dev v0.46.0
 	gorm.io/gorm v1.31.2
 )
 
@@ -102,7 +103,6 @@ require (
 	go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect
 	go.opentelemetry.io/otel/trace v1.44.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	gocloud.dev v0.46.0 // indirect
 	golang.org/x/crypto v0.57.0 // indirect
 	golang.org/x/image v0.46.0 // indirect
 	golang.org/x/net v0.58.0 // indirect