fix: require auth on submitFeedback mutation

[damsleth]

Summary

• submitFeedback on UserResolver had no @Authorized guard, and /graphql is a public Express route, so unauthenticated callers could invoke the mutation and spam GitHub issues on the feedback repo using our app-configured credentials.
• Add @Authorized<IAuthOptions>({ requiresUserContext: true }) - matching the pattern already used on updateUserConfiguration and updateUserTimebank - so anonymous requests are rejected with UNAUTHENTICATED at the TypeGraphQL layer before any GitHubService.createIssue call.
• IAuthOptions was already imported, so no new imports are needed.
• Add server/graphql/resolvers/user/UserResolver.test.ts covering the feedback auth option shape against authChecker: unauthenticated rejected, authenticated accepted.

Test plan

• npm run lint clean
• npm test - 3 new submitFeedback auth tests pass; no new uncaught exceptions introduced (the 5 pre-existing TS compile failures on unrelated test files are unchanged from dev)
• Confirmed via grep -rn submitFeedback client/ that the only client call site is client/parts/UserFeedback/FeedbackPanel/useSubmitFeedback.ts, which lives inside the logged-in shell - no unauthenticated UI path

Non-goals

• Rate limiting (separate concern, called out in the plan).