Endpoint for users AND client surfaces to report issues into the agent pipeline (ingest -> error_events_v1 -> watcher/support investigator).

OPTIONAL auth: a valid Bearer token attaches the reporter's profile_id; without one the report is still accepted anonymously (profile_id=None) so PRE-LOGIN crashes reach the agent instead of being rejected with 401. Accepts any JSON body — normalised by the ingestor.

Hardened (see docs/security-posture.md): rate-limited per profile/IP, and the attacker-controllable fields are size-capped at ingress. The trust gate that stops anonymous reports before the paid RCA call lives downstream in the watcher (only authenticated reports reach RCA). Nothing downstream writes code: the fixer was retired 2026-09-02 (docs/briefs/retired-decisions.md, AGENT-01).