Submit feedback on a message

Record message-level (upvote / downvote / copy, requires messageId) or conversation-level (csat 1-5, nps 0-10, requires rating) feedback for a client-token session. Requires the client token (authenticated like /init and /chat): the token is verified, its origin allowlist is enforced, and the session lookup is scoped to the token. Idempotent per (session, type, message): a matching prior submission is updated. Expired-but-active sessions are accepted so post-conversation surveys still land.