feedback: thumb up/down on logs + reviewer self-score 0-10

Two unrelated features bundled because they ship together and share
migration 0028.

Strategic-log feedback (thumb up/down):
- New strategic_log_feedback table with UNIQUE(log_id, user_id) so each
  user has one vote per log, flippable in place (up -> down -> clear).
  UI shows aggregate counts only.
- app/services/log_feedback.py: set_vote, get_counts, sign/verify
  feedback tokens (same itsdangerous pattern as auth.sign_pending,
  30-day TTL for email links).
- POST /api/log/{id}/feedback: web vote, auth required, returns counts
  + the requesting user's own vote.
- GET /feedback?token=...&vote=...: email-link target, no auth, signed
  token encodes (user, log, vote), renders feedback_thanks.html.
- partials/log.html: thumbs row below content, JS-driven swap via the
  POST endpoint. Dashboard latest-log card and /log page both render
  this partial via htmx, so the buttons appear in all three surfaces.
- digest emails: a "How was today's read?" row above the unsub footer,
  with signed-token URLs against the latest StrategicLog at send time.
  Plain-text fallback included.

Reviewer self-score (0-10):
- _SYSTEM_PROMPT asks for an integer score with anchors (10 exemplary,
  5 borderline, 0 unfit). Verdict gains score: int | None.
- Deterministic-layer hits get score=0 (hard rule, no nuance);
  error rows get None; LLM rows get the model's score clamped 0..10.
- ReviewerVerdict.score, StrategicLog.reviewer_score, and
  IndicatorSummary.reviewer_score all new SMALLINT NULL columns.
- ai_log_job + indicator_summary_job persist verdict.score onto their
  content rows when committing the row alongside content.

Tests:
- tests/test_strategic_log_feedback.py: vote, flip, clear, aggregate
  across users, invalid vote, token round-trip + tamper + garbage +
  'clear' not signable for email path.
- tests/test_output_review.py: score parsing, clamping (>10, <0),
  missing/non-numeric -> None, deterministic-layer score=0.

Full suite: 427 passed (was 412), 5 skipped, no regressions.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

alembic/versions/0028_log_feedback_and_reviewer_score.py

@@ -0,0 +1,93 @@
+"""strategic_log_feedback + reviewer_score columns.
+
+Revision ID: 0028
+Revises: 0027
+Create Date: 2026-05-29
+
+Two unrelated features bundled because they ship together:
+
+1. **strategic_log_feedback** — thumb up/down votes per (log, user).
+   UNIQUE on (log_id, user_id) enforces one vote per user per log,
+   flippable in place. The UI shows aggregate counts only.
+
+2. **reviewer_score** — the output reviewer now self-rates each
+   verdict 0-10 (10 = exemplary editorial, 0 = unfit). Stored on
+   strategic_logs, indicator_summaries, and every reviewer_verdicts
+   audit row, as nullable SMALLINT so existing rows aren't backfilled.
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+
+revision: str = "0028"
+down_revision: Union[str, None] = "0027"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # --- reviewer_score columns (nullable SMALLINT) -----------------------
+    op.add_column(
+        "strategic_logs",
+        sa.Column("reviewer_score", sa.SmallInteger(), nullable=True),
+    )
+    op.add_column(
+        "indicator_summaries",
+        sa.Column("reviewer_score", sa.SmallInteger(), nullable=True),
+    )
+    op.add_column(
+        "reviewer_verdicts",
+        sa.Column("score", sa.SmallInteger(), nullable=True),
+    )
+
+    # --- strategic_log_feedback table -------------------------------------
+    op.create_table(
+        "strategic_log_feedback",
+        sa.Column(
+            "id",
+            sa.BigInteger().with_variant(sa.Integer(), "sqlite"),
+            primary_key=True, autoincrement=True,
+        ),
+        sa.Column(
+            "log_id",
+            sa.BigInteger().with_variant(sa.Integer(), "sqlite"),
+            sa.ForeignKey("strategic_logs.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "user_id", sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        # 'up' or 'down'. Storing as varchar keeps the column readable in
+        # the DB shell; the enum-ness is enforced at the service layer.
+        sa.Column("vote", sa.String(length=8), nullable=False),
+        sa.Column(
+            "created_at", sa.DateTime(timezone=True), nullable=False,
+            server_default=sa.text("CURRENT_TIMESTAMP"),
+        ),
+        sa.Column(
+            "updated_at", sa.DateTime(timezone=True), nullable=False,
+            server_default=sa.text("CURRENT_TIMESTAMP"),
+        ),
+        sa.UniqueConstraint(
+            "log_id", "user_id", name="uq_slf_log_user",
+        ),
+    )
+    op.create_index(
+        "ix_strategic_log_feedback_log",
+        "strategic_log_feedback", ["log_id"],
+    )
+
+
+def downgrade() -> None:
+    op.drop_index(
+        "ix_strategic_log_feedback_log",
+        table_name="strategic_log_feedback",
+    )
+    op.drop_table("strategic_log_feedback")
+    op.drop_column("reviewer_verdicts", "score")
+    op.drop_column("indicator_summaries", "reviewer_score")
+    op.drop_column("strategic_logs", "reviewer_score")