feat(notifications): handle feedback.submitted from Room TBA

[smmariquit]

Closes #7.

Room TBA's in-app feedback box (uplbtools/room-tba#888) emits feedback.submitted through the existing notification gateway. The envelope enum did not list the type, so /notifications answered 400 and the submission only ever reached the server log. Nothing was lost — the feedback table in Room TBA is the system of record — but nobody was told a student wrote in.

Payload

Matched to the emit site on origin/feat/in-app-feedback (src/lib/notifications/types.ts, src/pages/api/feedback.ts), no invented fields:

Field	Type
feedbackId	number
message	string
contact	string | null
screen	string | null
appVersion	string | null
wasOnline	boolean | null

Routes to #development rather than #contributors: #contributors is documented as map edit proposals, and a submission can carry a contact address. Easy to move if the team wants it elsewhere.

Rendering untrusted text

/api/feedback is public and unauthenticated, so the body is attacker-controlled. Room TBA validates and rate limits; this PR only renders safely.

• Parsed, not cast. The handler runs feedbackSubmittedPayloadSchema.parse, unlike the proposal handlers which cast.
• Markdown escaped, including masked links, so a submission cannot render [totally the admin panel](https://evil.example) into the channel.
• Mentions neutralised with a zero-width space after every @ — @everyone, @here, <@&role> all stop resolving while the text stays readable. Belt and braces: allowedMentions: { parse: [] } now applies to every Discord send in this bot, not just this path.
• Truncated with an ellipsis so an over-long body loses its tail instead of Discord rejecting the whole message.
• Raw text is cut before escaping. escapeMarkdown is quadratic: 22k chars measured at ~7s of blocked event loop (20s for plain text). Bounding the input at Room TBA's own 2000-char cap keeps it at ~55ms. There is a test asserting this stays under 1s.

Short context values (screen, app version) take a lighter path: whitespace is collapsed so no line start remains for heading/list markdown, which also avoids rendering an app version as 2026\.08.01.

Verification

bun run check — biome, tsc --noEmit, bun test, tsc build. 65 pass, 0 fail. The one biome warning (github-repo.ts optional chain) is pre-existing and untouched.

New tests cover: schema accepts the real payload and both null-context and malformed variants, mention text is neutralised, over-long bodies truncate rather than throw, the quadratic path stays fast, and POST /notifications now accepts a feedback.submitted envelope end to end.

Not merged, not deployed — Heroku still needs git push heroku main after merge.