Add Feedback domain module: public submission flow, admin CRUD, reporting

New /feedback API domain backed by its own FEEDBACK_DB, mirroring the
Calendar domain's router -> service -> DB pool layering:

- Public endpoints (no auth): eligible-events listing, event config,
  submission with honeypot + rate limiting (in-memory + DB backstop).
- Admin endpoints (session-header auth, reusing Calendar's users/sessions
  via a swappable feedback.auth.ts boundary): events/songs/questions CRUD,
  bulk reorder/assignment, aggregated reporting, CSV export.
- Schema in sql/feedback/001_init.sql (8 tables), applied and verified
  against the real FEEDBACK_DB.
- 64 Jest tests covering validation, auth, rate limiting, CSV escaping,
  and report aggregation (pure functions, no DB needed).

Includes fixes from a security review: path traversal defense doesn't
apply here (that's the frontend proxy, separate repo), but the
rate-limiter cluster does - recordSubmission now counts every processed
request (not just successful ones), the in-memory Map evicts empty
entries instead of growing unbounded, FEEDBACK_IP_SALT is required at
boot instead of silently degrading to unsalted hashing, and submission
answer/rating arrays are capped and de-duplicated to bound insert
amplification.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app.ts

@@ -7,6 +7,7 @@ import logger from './src/middleware/logger';
 
 // Router imports
 import {calendarRouter} from './src/models/calendar/Calendar.router';
+import {feedbackRouter} from './src/models/feedback/Feedback.router';
 
 
 let cors = require('cors');
@@ -23,19 +24,34 @@ const port: number = parseInt(process.env.PORT, 10);
 const app: express.Application = express();
 const server: http.Server = http.createServer(app);
 
+// Behind Plesk's nginx, req.ip is the proxy unless we trust the forwarded header.
+// Verify the resolved client IP is correct in staging before relying on it
+// (used by the feedback rate limiter).
+app.set('trust proxy', 1);
+
 // here we are adding middleware to parse all incoming requests as JSON
 app.use(express.json());
 
 // Configure CORS
 let allowedHosts = [
 	'https://www.nachklang.art',
-	'https://calendar.nachklang.art'
+	'https://calendar.nachklang.art',
+	'https://feedback.nachklang.art'
 ];
+const isDev = process.env.NODE_ENV !== 'production';
+const localhostRegex = /^http:\/\/localhost:\d+$/;
 app.use(cors({
+	allowedHeaders: ['Content-Type', 'X-Session-Id', 'X-Session-Key'],
 	origin: function (origin: any, callback: any) {
 		// Allow requests with no origin
 		if (!origin) return callback(null, true);
 
+		// Any localhost port is fine outside production - dev servers pick
+		// whatever port is free (Next.js falls back from 3000 if it's taken).
+		if (isDev && localhostRegex.test(origin)) {
+			return callback(null, true);
+		}
+
 		// Block requests with wrong origin
 		if (allowedHosts.indexOf(origin) === -1) {
 			return callback(new Error('The CORS policy doesn\'t allow access for your origin.'), false);
@@ -82,6 +98,7 @@ app.use(
 
 // Add routers
 app.use('/calendar', calendarRouter);
+app.use('/feedback', feedbackRouter);
 
 // this is a simple route to make sure everything is working properly
 app.get('/', (req: express.Request, res: express.Response) => {