Submit Feedback

Capture one feedback submission and email a verification link.

Checks, in order: rate limit (429 past threshold, fail-open on limiter errors -- see databeat/rate_limit.py), comment length bounds (400 outside [10, 2000] characters), basic email shape (400 if it doesn't look like an email at all).

A failed verification-email SEND (e.g. RESEND_API_KEY unset, or Resend itself rejecting the request) does not fail the submission — the row is already durably stored, which is the useful part (spec section 4: unverified submissions are kept, not discarded). The failure is logged to stderr so it is visible in server logs, and surfaced back to the caller via email_sent: false rather than hidden, but the HTTP status stays 200: the reader's feedback was captured either way.