fe_comment v2: FE-user feedback tickets with summary, uploads and API

- Replace the v1 submit endpoint with a full JSON API under
  /api/fe-comment/ (state, feedback create/update/delete, uploads,
  summary notes/recipients, submit), guarded by frontend login and a
  configurable FE user group; unauthorized callers get {"allowed":false}
- New models: tx_fecomment_summary (one open ticket per user, status
  open/sent) and tx_fecomment_feedback (url, RTE note, FAL attachments),
  both editable in the backend on the ticket storage page
- FeedbackApiMiddleware registered after frontend authentication (the
  frontend.user attribute does not exist earlier); uploads land in
  fileadmin/fe_comment/summary-<uid>/ with mime/extension check, 20 MB cap
- Submit sends one HTML mail (author block, items with attachment links,
  reply-to = FE user mail) to selected recipients with mailTo fallback,
  then closes the summary
- felogin wired React-compatible: felogin.pid=520 plus headless FeLogin
  JSON templates via site settings - felogin v14 and EXT:headless both
  claim templateRootPaths.10, the felogin.view.* settings feed exactly
  that index, so the structured JSON form (incl. __RequestToken) wins
- Read the sys_file_reference insert id before syncAttachmentCount():
  DBAL throws "no identity value" once the count UPDATE has run
- migrations: drop_fecomment_tables.php (repairs the no-uid tables,
  only drops when empty), check_feuser.php (login diagnosis),
  fec_login_test.sh / fec_api_test.sh (curl chains incl. CSRF token flow)

migrations/fec_login_test.sh

@@ -0,0 +1,53 @@
+#!/bin/bash
+# fe_comment Login-Testkette: GET (Nonce+Token) -> Login-POST -> state
+# Aufruf: bash migrations/fec_login_test.sh  (fragt das Passwort unsichtbar ab)
+set -e
+cd /usr/www/users/vitecevo/live
+BASE=https://dev.vitec.com
+
+read -rsp "Passwort fuer joe: " PASS; echo
+
+rm -f /tmp/fec.jar
+curl -sS -c /tmp/fec.jar -o /tmp/fec_form.json "$BASE/_json/fe-user-profile"
+
+TOKEN=$(php -r '
+$j = json_decode(file_get_contents("/tmp/fec_form.json"), true);
+$f = "";
+$w = function ($n) use (&$w, &$f) {
+    if (is_array($n)) {
+        // Variante 1: strukturiertes headless-Formular {name: "__RequestToken", value: "..."}
+        if (($n["name"] ?? "") === "__RequestToken" && isset($n["value"])) {
+            $f = (string)$n["value"];
+        }
+        foreach ($n as $c) { $w($c); }
+    } elseif (is_string($n) && $f === "") {
+        // Variante 2: felogin rendert klassisches HTML als String im JSON
+        if (preg_match("/name=\"__RequestToken\" value=\"([^\"]+)\"/", $n, $m)) {
+            $f = $m[1];
+        }
+    }
+};
+$w($j);
+echo $f;
+')
+
+echo "Nonce-Cookies im Jar: $(grep -c typo3nonce /tmp/fec.jar || true)"
+echo "Token-Laenge:         ${#TOKEN}"
+if [ -z "$TOKEN" ]; then
+    echo "KEIN __RequestToken im Seiten-JSON gefunden."
+    echo "Vorkommen von 'RequestToken' im JSON (zur Diagnose):"
+    grep -o 'RequestToken[^"]*"[^"]*"' /tmp/fec_form.json | head -n 3 || echo "(keine)"
+    exit 1
+fi
+
+curl -sS -b /tmp/fec.jar -c /tmp/fec.jar -o /tmp/fec_login.json \
+    --data-urlencode "user=joe" \
+    --data-urlencode "pass=$PASS" \
+    --data-urlencode "logintype=login" \
+    --data-urlencode "pid=520" \
+    --data-urlencode "__RequestToken=$TOKEN" \
+    "$BASE/_json/fe-user-profile"
+
+echo "Session-Cookies (fe_typo_user): $(grep -c fe_typo_user /tmp/fec.jar || true)"
+echo '--- state ---'
+curl -sS -b /tmp/fec.jar "$BASE/api/fe-comment/state"; echo