In-site feedback reply (plain-text v1)

Reply to a reader from the admin inbox instead of a mailto. Per Codex: keep v1
plain text (no rich editor — defers the user's bold/bullets ask as a fast-follow).

* DB: feedback_replies table (feedback_id, user_id, message, sent_to, sent_at),
  created on the live DB.
* email_send.send_feedback_reply: plain-text "Re: Your Upbeat Bytes feedback"
  with a quoted context block, no analytics/account details.
* API: POST /api/admin/feedback/{id}/reply — admin-gated, requires the feedback
  exists (404) and has a contact_email (400), trims+caps the message; sends via
  SMTP and only records the reply on success (502 on send failure so the UI keeps
  the draft); marks the item read. Feedback list now includes each item's replies.
* Frontend: inline composer (Send/Cancel, sending state, error keeps draft) +
  reply thread under the message; Reply only shows when there's an address,
  else "No reply address".

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

goodnews/api.py

@@ -381,6 +381,10 @@ class FeedbackReadBody(BaseModel):
     read: bool = True
 
 
+class FeedbackReplyBody(BaseModel):
+    message: str = ""
+
+
 class SourceActiveBody(BaseModel):
     active: bool = True
 
@@ -799,7 +803,21 @@ def create_app() -> FastAPI:
                 "u.email AS user_email FROM feedback f LEFT JOIN users u ON u.id = f.user_id "
                 "ORDER BY f.created_at DESC LIMIT 200"
             ).fetchall()
-        return [dict(r) for r in rows]
+            items = [dict(r) for r in rows]
+            if items:
+                ids = [it["id"] for it in items]
+                ph = ",".join("?" * len(ids))
+                reps = conn.execute(
+                    f"SELECT id, feedback_id, message, sent_to, sent_at FROM feedback_replies "
+                    f"WHERE feedback_id IN ({ph}) ORDER BY sent_at",
+                    ids,
+                ).fetchall()
+                by_fid: dict = {}
+                for r in reps:
+                    by_fid.setdefault(r["feedback_id"], []).append(dict(r))
+                for it in items:
+                    it["replies"] = by_fid.get(it["id"], [])
+        return items
 
     @app.post("/api/admin/feedback/{fid}/read")
     def admin_feedback_read(fid: int, body: FeedbackReadBody, request: Request) -> dict:
@@ -822,6 +840,38 @@ def create_app() -> FastAPI:
             conn.commit()
         return {"ok": True}
 
+    @app.post("/api/admin/feedback/{fid}/reply")
+    def admin_feedback_reply(fid: int, body: FeedbackReplyBody, request: Request) -> dict:
+        message = (body.message or "").strip()[:4000]
+        if not message:
+            raise HTTPException(status_code=422, detail="Reply message is required.")
+        with get_conn() as conn:
+            admin = _require_admin(conn, request)
+            fb = conn.execute("SELECT contact_email, message FROM feedback WHERE id = ?", (fid,)).fetchone()
+            if not fb:
+                raise HTTPException(status_code=404, detail="feedback not found")
+            if not fb["contact_email"]:
+                raise HTTPException(status_code=400, detail="No reply address for this feedback.")
+            # Send first — only record a reply that actually went out, so the UI
+            # can keep the draft on failure.
+            try:
+                email_send.send_feedback_reply(fb["contact_email"], message, fb["message"])
+            except Exception as exc:  # noqa: BLE001 — surface any SMTP failure to the admin
+                raise HTTPException(status_code=502, detail=f"Could not send the reply: {exc}")
+            cur = conn.execute(
+                "INSERT INTO feedback_replies (feedback_id, user_id, message, sent_to) VALUES (?, ?, ?, ?)",
+                (fid, admin["id"], message, fb["contact_email"]),
+            )
+            conn.execute(
+                "UPDATE feedback SET read_at = COALESCE(read_at, CURRENT_TIMESTAMP) WHERE id = ?", (fid,)
+            )
+            conn.commit()
+            reply = conn.execute(
+                "SELECT id, feedback_id, message, sent_to, sent_at FROM feedback_replies WHERE id = ?",
+                (cur.lastrowid,),
+            ).fetchone()
+        return {"ok": True, "reply": dict(reply)}
+
     @app.post("/api/admin/sources/{sid}/active")
     def admin_source_active(sid: int, body: SourceActiveBody, request: Request) -> dict:
         # Pause/resume a feed. Pausing only stops future polling — its already-