Feedback admin: check rowcount before commit (tidy 404 path)

Per Codex note: raise the 404 before commit so a no-match read/delete commits
nothing. get_conn only closes (no auto-commit), so this is clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

goodnews/api.py

@@ -798,9 +798,9 @@ def create_app() -> FastAPI:
             _require_admin(conn, request)
             ts = "CURRENT_TIMESTAMP" if body.read else "NULL"
             cur = conn.execute(f"UPDATE feedback SET read_at = {ts} WHERE id = ?", (fid,))
-            conn.commit()
             if cur.rowcount == 0:
                 raise HTTPException(status_code=404, detail="feedback not found")
+            conn.commit()
         return {"ok": True, "read": body.read}
 
     @app.delete("/api/admin/feedback/{fid}")
@@ -808,9 +808,9 @@ def create_app() -> FastAPI:
         with get_conn() as conn:
             _require_admin(conn, request)
             cur = conn.execute("DELETE FROM feedback WHERE id = ?", (fid,))
-            conn.commit()
             if cur.rowcount == 0:
                 raise HTTPException(status_code=404, detail="feedback not found")
+            conn.commit()
         return {"ok": True}
 
     @app.get("/api/admin/stats")