feat: auth user feedbacks

internal/server/server.go

@@ -953,10 +953,20 @@ func (s *Server) setupRouter() {
 		r.Group(func(r chi.Router) {
 			if s.feedbackH == nil {
 				r.HandleFunc("/feedback", s.authUnavailable)
+				r.HandleFunc("/feedback/mine", s.authUnavailable)
 				return
 			}
-			r.Use(middleware.OptionalAuth(s.authIssuer, s.userRepo))
-			r.Post("/feedback", s.feedbackH.Submit)
+			// Submit — OptionalAuth (anonymous callers allowed).
+			r.Group(func(r chi.Router) {
+				r.Use(middleware.OptionalAuth(s.authIssuer, s.userRepo))
+				r.Post("/feedback", s.feedbackH.Submit)
+			})
+			// My submissions — RequireAuth. Lists the caller's own rows
+			// with status + admin reply for the /settings/feedbacks page.
+			r.Group(func(r chi.Router) {
+				r.Use(middleware.RequireAuth(s.authIssuer, s.userRepo))
+				r.Get("/feedback/mine", s.feedbackH.Mine)
+			})
 		})
 
 		// Notifications — the signed-in user's in-app feed + unread badge.