feedback: thumb up/down on logs + reviewer self-score 0-10

Two unrelated features bundled because they ship together and share
migration 0028.

Strategic-log feedback (thumb up/down):
- New strategic_log_feedback table with UNIQUE(log_id, user_id) so each
  user has one vote per log, flippable in place (up -> down -> clear).
  UI shows aggregate counts only.
- app/services/log_feedback.py: set_vote, get_counts, sign/verify
  feedback tokens (same itsdangerous pattern as auth.sign_pending,
  30-day TTL for email links).
- POST /api/log/{id}/feedback: web vote, auth required, returns counts
  + the requesting user's own vote.
- GET /feedback?token=...&vote=...: email-link target, no auth, signed
  token encodes (user, log, vote), renders feedback_thanks.html.
- partials/log.html: thumbs row below content, JS-driven swap via the
  POST endpoint. Dashboard latest-log card and /log page both render
  this partial via htmx, so the buttons appear in all three surfaces.
- digest emails: a "How was today's read?" row above the unsub footer,
  with signed-token URLs against the latest StrategicLog at send time.
  Plain-text fallback included.

Reviewer self-score (0-10):
- _SYSTEM_PROMPT asks for an integer score with anchors (10 exemplary,
  5 borderline, 0 unfit). Verdict gains score: int | None.
- Deterministic-layer hits get score=0 (hard rule, no nuance);
  error rows get None; LLM rows get the model's score clamped 0..10.
- ReviewerVerdict.score, StrategicLog.reviewer_score, and
  IndicatorSummary.reviewer_score all new SMALLINT NULL columns.
- ai_log_job + indicator_summary_job persist verdict.score onto their
  content rows when committing the row alongside content.

Tests:
- tests/test_strategic_log_feedback.py: vote, flip, clear, aggregate
  across users, invalid vote, token round-trip + tamper + garbage +
  'clear' not signable for email path.
- tests/test_output_review.py: score parsing, clamping (>10, <0),
  missing/non-numeric -> None, deterministic-layer score=0.

Full suite: 427 passed (was 412), 5 skipped, no regressions.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/services/log_feedback.py

@@ -0,0 +1,177 @@
+"""Thumb up/down votes on strategic-log rows.
+
+The model is one row per (log_id, user_id) — see
+``app/models.py::StrategicLogFeedback``. The UI shows aggregate counts
+only; user attribution is server-side state, not surface state. A user
+can flip up → down (or vice versa) by re-submitting; "clear" deletes
+the row.
+
+For email-digest feedback links we sign a short payload with the same
+itsdangerous serialiser pattern used elsewhere (``app/auth.py``). The
+link is single-purpose: it identifies the (user, log, intended vote)
+combination, lets the recipient click without being logged in, and
+expires after EMAIL_FEEDBACK_TTL_SECONDS.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from itsdangerous import BadSignature, SignatureExpired, URLSafeTimedSerializer
+from sqlalchemy import delete, func, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.config import get_settings
+from app.db import utcnow
+from app.models import StrategicLogFeedback
+
+
+# Email-link tokens are valid for 30 days so a user can click the thumb
+# in last week's Sunday digest. Long enough for slow readers; short
+# enough that the signing-secret rotation can shake stale tokens off.
+EMAIL_FEEDBACK_TTL_SECONDS = 30 * 24 * 60 * 60
+
+# Discriminated enum of acceptable votes. "clear" is a sentinel that
+# means "remove your existing vote, if any".
+VALID_VOTES = ("up", "down", "clear")
+
+
+class FeedbackError(ValueError):
+    """Raised on bad input. Message is safe to surface to the user."""
+
+
+@dataclass(frozen=True)
+class FeedbackCounts:
+    up: int
+    down: int
+    user_vote: str | None  # 'up' | 'down' | None
+
+
+# ---------------------------------------------------------------------------
+# Service
+# ---------------------------------------------------------------------------
+
+
+def _validate_vote(vote: str) -> str:
+    v = (vote or "").strip().lower()
+    if v not in VALID_VOTES:
+        raise FeedbackError(
+            f"vote must be one of {VALID_VOTES!r}; got {vote!r}"
+        )
+    return v
+
+
+async def set_vote(
+    session: AsyncSession,
+    *,
+    log_id: int,
+    user_id: int,
+    vote: str,
+) -> FeedbackCounts:
+    """Insert / update / clear the user's vote on ``log_id``. Returns the
+    resulting aggregate counts plus the user's new vote state.
+
+    "clear" removes the row entirely; "up"/"down" upserts. The unique
+    index on (log_id, user_id) guarantees there's never more than one
+    row per pair."""
+    v = _validate_vote(vote)
+
+    if v == "clear":
+        await session.execute(
+            delete(StrategicLogFeedback)
+            .where(StrategicLogFeedback.log_id == log_id)
+            .where(StrategicLogFeedback.user_id == user_id)
+        )
+        await session.commit()
+        return await get_counts(session, log_id=log_id, user_id=user_id)
+
+    # Upsert by hand — SQLAlchemy's portable dialect doesn't expose
+    # ON DUPLICATE KEY UPDATE across MySQL+SQLite reliably for our test
+    # path, so SELECT then INSERT-or-UPDATE is the simplest correct shape.
+    existing = (await session.execute(
+        select(StrategicLogFeedback)
+        .where(StrategicLogFeedback.log_id == log_id)
+        .where(StrategicLogFeedback.user_id == user_id)
+    )).scalar_one_or_none()
+    if existing is None:
+        session.add(StrategicLogFeedback(
+            log_id=log_id, user_id=user_id, vote=v,
+            created_at=utcnow(), updated_at=utcnow(),
+        ))
+    else:
+        existing.vote = v
+        existing.updated_at = utcnow()
+    await session.commit()
+    return await get_counts(session, log_id=log_id, user_id=user_id)
+
+
+async def get_counts(
+    session: AsyncSession,
+    *,
+    log_id: int,
+    user_id: int | None = None,
+) -> FeedbackCounts:
+    """Aggregate up/down counts for one log, plus the requesting user's
+    own vote (if ``user_id`` is supplied). One indexed query for the
+    counts; a second indexed lookup for the personal vote."""
+    rows = (await session.execute(
+        select(
+            StrategicLogFeedback.vote,
+            func.count(StrategicLogFeedback.id),
+        )
+        .where(StrategicLogFeedback.log_id == log_id)
+        .group_by(StrategicLogFeedback.vote)
+    )).all()
+    counts = {vote: int(n) for vote, n in rows}
+    user_vote: str | None = None
+    if user_id is not None:
+        user_vote = (await session.execute(
+            select(StrategicLogFeedback.vote)
+            .where(StrategicLogFeedback.log_id == log_id)
+            .where(StrategicLogFeedback.user_id == user_id)
+        )).scalar_one_or_none()
+    return FeedbackCounts(
+        up=counts.get("up", 0),
+        down=counts.get("down", 0),
+        user_vote=user_vote,
+    )
+
+
+# ---------------------------------------------------------------------------
+# Email-link token helpers (parallel to app.auth.sign_pending)
+# ---------------------------------------------------------------------------
+
+
+def _feedback_serializer() -> URLSafeTimedSerializer:
+    s = get_settings()
+    secret = s.CASSANDRA_SESSION_SECRET or s.CASSANDRA_TOKEN or "dev-insecure-secret"
+    return URLSafeTimedSerializer(secret, salt="cassandra-log-feedback-v1")
+
+
+def sign_feedback_token(user_id: int, log_id: int, vote: str) -> str:
+    """Signed token for an email-digest thumb link. Encodes the intended
+    (user, log, vote) tuple. The recipient clicks the link without being
+    logged in; the receiving endpoint verifies the signature, applies the
+    vote, and shows a thank-you page."""
+    v = _validate_vote(vote)
+    if v == "clear":
+        raise FeedbackError("clear is not a valid email-link vote")
+    return _feedback_serializer().dumps({
+        "uid": int(user_id), "lid": int(log_id), "v": v,
+    })
+
+
+def verify_feedback_token(token: str) -> dict | None:
+    """Returns {"user_id": int, "log_id": int, "vote": "up"|"down"} on
+    valid + un-expired tokens, or None on bad signature / expired / bad
+    payload. The TTL is ``EMAIL_FEEDBACK_TTL_SECONDS``."""
+    try:
+        data = _feedback_serializer().loads(
+            token, max_age=EMAIL_FEEDBACK_TTL_SECONDS,
+        )
+        return {
+            "user_id": int(data["uid"]),
+            "log_id": int(data["lid"]),
+            "vote": str(data["v"]),
+        }
+    except (BadSignature, SignatureExpired, KeyError, TypeError, ValueError):
+        return None