fe_comment v2: FE-user feedback tickets with summary, uploads and API

- Replace the v1 submit endpoint with a full JSON API under
  /api/fe-comment/ (state, feedback create/update/delete, uploads,
  summary notes/recipients, submit), guarded by frontend login and a
  configurable FE user group; unauthorized callers get {"allowed":false}
- New models: tx_fecomment_summary (one open ticket per user, status
  open/sent) and tx_fecomment_feedback (url, RTE note, FAL attachments),
  both editable in the backend on the ticket storage page
- FeedbackApiMiddleware registered after frontend authentication (the
  frontend.user attribute does not exist earlier); uploads land in
  fileadmin/fe_comment/summary-<uid>/ with mime/extension check, 20 MB cap
- Submit sends one HTML mail (author block, items with attachment links,
  reply-to = FE user mail) to selected recipients with mailTo fallback,
  then closes the summary
- felogin wired React-compatible: felogin.pid=520 plus headless FeLogin
  JSON templates via site settings - felogin v14 and EXT:headless both
  claim templateRootPaths.10, the felogin.view.* settings feed exactly
  that index, so the structured JSON form (incl. __RequestToken) wins
- Read the sys_file_reference insert id before syncAttachmentCount():
  DBAL throws "no identity value" once the count UPDATE has run
- migrations: drop_fecomment_tables.php (repairs the no-uid tables,
  only drops when empty), check_feuser.php (login diagnosis),
  fec_login_test.sh / fec_api_test.sh (curl chains incl. CSRF token flow)

migrations/fec_api_test.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+# fe_comment API-Testkette (braucht eingeloggte Session aus fec_login_test.sh)
+# Aufruf: bash migrations/fec_api_test.sh
+set -e
+cd /usr/www/users/vitecevo/live
+BASE=https://dev.vitec.com
+JAR=/tmp/fec.jar
+[ -s "$JAR" ] || { echo "Cookie-Jar fehlt - erst migrations/fec_login_test.sh laufen lassen."; exit 1; }
+
+echo '--- 1) Feedback anlegen (mit Sanitizer-Probe: script-Tag muss verschwinden, strong bleiben) ---'
+curl -sS -b "$JAR" -H 'Content-Type: application/json' \
+    -d '{"url":"https://dev.vitec.com/testseite","note":"<p>Erster Test <script>alert(1)</script> mit <strong>fett</strong></p>"}' \
+    "$BASE/api/fe-comment/feedback" | tee /tmp/fec_fb.json; echo
+
+FB=$(php -r '$j=json_decode(file_get_contents("/tmp/fec_fb.json"),true);echo (int)($j["uid"]??0);')
+echo "Feedback-UID: $FB"
+[ "$FB" -gt 0 ] || { echo "Anlegen fehlgeschlagen."; exit 1; }
+
+echo '--- 2) Feedback aendern ---'
+curl -sS -b "$JAR" -H 'Content-Type: application/json' \
+    -d '{"note":"<p>Geaenderte Notiz, <em>kursiv</em>.</p>"}' \
+    "$BASE/api/fe-comment/feedback/$FB"; echo
+
+echo '--- 3) Datei-Upload (Test-PNG vom Server) ---'
+curl -sS -b "$JAR" \
+    -F "file=@public/testimages/placeholder_1920x600.png;type=image/png" \
+    -F "feedback=$FB" \
+    "$BASE/api/fe-comment/upload"; echo
+
+echo '--- 4) General Notes an der Summary ---'
+curl -sS -b "$JAR" -H 'Content-Type: application/json' \
+    -d '{"generalNotes":"<p>Bitte alles einmal durchsehen.</p>","recipients":[]}' \
+    "$BASE/api/fe-comment/summary"; echo
+
+echo '--- 5) Gesamtzustand ---'
+curl -sS -b "$JAR" "$BASE/api/fe-comment/state"; echo
+
+read -rp "6) Submit ausloesen (Mail an die mailTo-Adresse)? [j/N] " yn
+if [[ "$yn" =~ ^[jJyY] ]]; then
+    curl -sS -b "$JAR" -X POST "$BASE/api/fe-comment/submit"; echo
+    echo '--- state nach Submit (Summary sollte weg/neu sein) ---'
+    curl -sS -b "$JAR" "$BASE/api/fe-comment/state"; echo
+fi