Add Feedback domain module: public submission flow, admin CRUD, reporting

New /feedback API domain backed by its own FEEDBACK_DB, mirroring the
Calendar domain's router -> service -> DB pool layering:

- Public endpoints (no auth): eligible-events listing, event config,
  submission with honeypot + rate limiting (in-memory + DB backstop).
- Admin endpoints (session-header auth, reusing Calendar's users/sessions
  via a swappable feedback.auth.ts boundary): events/songs/questions CRUD,
  bulk reorder/assignment, aggregated reporting, CSV export.
- Schema in sql/feedback/001_init.sql (8 tables), applied and verified
  against the real FEEDBACK_DB.
- 64 Jest tests covering validation, auth, rate limiting, CSV escaping,
  and report aggregation (pure functions, no DB needed).

Includes fixes from a security review: path traversal defense doesn't
apply here (that's the frontend proxy, separate repo), but the
rate-limiter cluster does - recordSubmission now counts every processed
request (not just successful ones), the in-memory Map evicts empty
entries instead of growing unbounded, FEEDBACK_IP_SALT is required at
boot instead of silently degrading to unsalted hashing, and submission
answer/rating arrays are capped and de-duplicated to bound insert
amplification.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -18,7 +18,7 @@ npx jest test/some.test.ts
 
 ## Architecture
 
-Express.js REST API in TypeScript with a service-oriented layering. The sole domain is `Calendar`, which organises **events** and **users**.
+Express.js REST API in TypeScript with a service-oriented layering. Domains: `Calendar` (events, users) and `Feedback` (concert feedback forms, mounted at `/feedback`, backed by its own `FEEDBACK_DB` — see `src/models/feedback/`, still scaffolding-only as of this writing).
 
 **Request path:**
 1. `app.ts` mounts `Calendar.router.ts` at `/calendar`
@@ -53,6 +53,13 @@ DB_HOST=
 DB_USER=
 DB_PASSWORD=
 CALENDAR_DB=
+FEEDBACK_DB=
+FEEDBACK_IP_SALT=
+FEEDBACK_RATE_LIMIT_MAX=
+FEEDBACK_RATE_LIMIT_WINDOW_MIN=
+SALESFORCE_ENABLED=
+SALESFORCE_API_URL=
+SALESFORCE_API_TOKEN=
 EMAIL_HOST=
 EMAIL_USERNAME=
 EMAIL_PASSWORD=