feat: feedback submissions with screenshots, the hide-widget preference and its user payload key

- POST /_feedback/api/v1/{key}/submit validates as PHP, refuses non-image screenshots (ImageContentGuard copy) and stores the submission, its public screenshot and the G15Office job in one transaction
- PUT /_feedback/api/v1/me/hidden (jwt.auth) stores the caller's preference; feedback_widget_hidden joins every golem15.user payload
- preflights stay with the framework CORS layer

routes.go

@@ -3,16 +3,22 @@ package feedback
 import (
 	"git.golem15.com/golem15/sm-feedback-plugin/controllers/api"
 	"git.golem15.com/golem15/summercms/modules/pact"
+	"git.golem15.com/golem15/summercms/modules/surf"
 )
 
 // Routes mounts the widget API. The public group has no auth: the widget
 // key in the path and the Origin allow-list are its gate, backed by the
 // per-IP buckets. CORS preflights (OPTIONS) on _feedback/api/* are answered
 // by surf's path-scoped CORS layer, which the application's http.cors.paths
-// must list, so no OPTIONS route is registered.
+// must list, so no OPTIONS route is registered. A second group on the same
+// prefix carries the per-user preference behind golem15.user's jwt.auth.
 func (p *Plugin) Routes(r pact.Router) error {
 	r.Group("/_feedback/api/v1", nil, func(g pact.Router) {
 		g.Get("/{key}/config", api.Config(p.app), "throttle:"+BucketConfig)
+		g.Post("/{key}/submit", api.Submit(p.app), "throttle:"+BucketSubmit)
+	})
+	r.Group("/_feedback/api/v1", surf.Use("jwt.auth"), func(g pact.Router) {
+		g.Put("/me/hidden", api.MeHidden(p.app))
 	})
 	return nil
 }