Feedback inbox: read/unread + delete

Make the admin Feedback section a real inbox.

* DB: feedback.read_at column (schema + idempotent migration).
* API: feedback list returns read_at; POST /api/admin/feedback/{id}/read
  {read} toggles it; DELETE /api/admin/feedback/{id} removes a message
  (both admin-gated). admin_stats gains feedback_unread; the Attention strip
  and the tab badge now count UNREAD, not total.
* Frontend: unread messages are highlighted with an accent rail + dot; an
  Unread filter joins the category chips; each message has Mark read/unread
  and Delete (confirm), with optimistic updates that revert on failure.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_feedback.py

@@ -50,3 +50,41 @@ def test_admin_feedback_gated(tmp_path, monkeypatch):
     stats = tc.get("/api/admin/stats").json()
     assert {"funnel", "accounts", "retention", "emotional_mix", "paywall", "replace"} <= set(stats)
     assert stats["accounts"]["total"] >= 1
+
+
+def _admin_client(tmp_path, monkeypatch):
+    app, api, db = _app(tmp_path, monkeypatch, admin="boss@x.com")
+    monkeypatch.setattr(api.email_send, "send_feedback", lambda *a, **k: None)
+    TestClient(app).post("/api/feedback", json={"message": "hello there", "visitor": "v"})
+    tc = TestClient(app); sent = {}
+    monkeypatch.setattr(api.email_send, "send_magic_link", lambda to, link: sent.update(link=link))
+    tc.post("/api/auth/email/start", json={"email": "boss@x.com"})
+    tc.post("/api/auth/email/verify", json={"token": sent["link"].split("token=")[1]})
+    return tc
+
+
+def test_feedback_read_unread_and_delete(tmp_path, monkeypatch):
+    tc = _admin_client(tmp_path, monkeypatch)
+    fb = tc.get("/api/admin/feedback").json()
+    fid = fb[0]["id"]
+    assert fb[0]["read_at"] is None                       # starts unread
+    assert tc.get("/api/admin/stats").json()["feedback_unread"] == 1
+
+    tc.post(f"/api/admin/feedback/{fid}/read", json={"read": True})
+    assert tc.get("/api/admin/feedback").json()[0]["read_at"] is not None
+    assert tc.get("/api/admin/stats").json()["feedback_unread"] == 0
+
+    tc.post(f"/api/admin/feedback/{fid}/read", json={"read": False})  # back to unread
+    assert tc.get("/api/admin/stats").json()["feedback_unread"] == 1
+
+    assert tc.delete(f"/api/admin/feedback/{fid}").json() == {"ok": True}
+    assert tc.get("/api/admin/feedback").json() == []
+
+
+def test_feedback_admin_actions_gated(tmp_path, monkeypatch):
+    app, api, db = _app(tmp_path, monkeypatch, admin="boss@x.com")
+    monkeypatch.setattr(api.email_send, "send_feedback", lambda *a, **k: None)
+    TestClient(app).post("/api/feedback", json={"message": "hi", "visitor": "v"})
+    anon = TestClient(app)
+    assert anon.post("/api/admin/feedback/1/read", json={"read": True}).status_code == 401
+    assert anon.delete("/api/admin/feedback/1").status_code == 401