feat: feedback APIs

[lovestaco]

• Add review_feedback table with vote_type, tags, comment_content,
  code_excerpt, severity, source_type, lrc_version, and retracted_at
• Add FeedbackStore for insert with pq.Array tag handling
• Add POST /api/v1/feedback, GET /impact-stats, PATCH /:id/retract
  under feedbackGroup protected by APIKeyAuthMiddleware
• Validate review ownership on submit via reviews+users join so users
  can only vote on their own reviews
• Retract requires INNER JOIN ownership check; floating feedback
  (no review_id) cannot be retracted since it has no user attribution
• Validate user_id from context explicitly in both handlers to prevent
  silent zero-value fallthrough
• Impact stats reads org_id from middleware context, not query param"