Store per-brief feedback from an authenticated user.

Same access gate as GET /briefs/{brief_id}: only the brief's owner, paid-team members of the brief's team, or admins may submit feedback. Without this check any signed-in user could pollute feedback rows for arbitrary briefs they've never seen (UNIQUE(brief_id, user_id) blocks duplicates from the same user but doesn't stop a user from spamming many distinct brief IDs).

Returns 404 (not 403) on access denial — same semantics as the read endpoint, so brief existence isn't leaked.