refactor(db): move product feedback store ownership

[TheSentinel454]

Summary

Continue tracker #2 by making product_feedback.rs own deployment-level product-feedback persistence. The records, SQL, row parsing, provenance behavior, and focused PostgreSQL test already lived there; this child moves the two remaining Db APIs and datastore spans out of lib.rs.

This also advances #17 and #19: the focused provenance test remains beside the implementation, and a source guard proves each record and logical operation has one owner and one span.

Stack

• Tracker: TheSentinel454/buzz#2
• Test ownership acceptance: #17
• Span ownership acceptance: #19
• Exact base: codex/issue-2-relay-invite-store at 849b817 (#6805)
• Exact head: codex/issue-2-product-feedback-store at 64fa6de

Domain moved

• Db::insert_product_feedback
• Db::list_product_feedback
• Both existing datastore spans, unchanged names and fixed labels
• A source guard covering unique facade/type/span ownership

crates/buzz-db/src/lib.rs falls from 4,211 to 4,192 lines.

Non-goals

• Moderation reports, restrictions, or audit actions; they remain a separate next child
• Product-feedback validation, idempotency, provenance, SQL, schema, ordering, or response behavior
• Generic store traits, raw pool access, executor migration, or crate reorganization

Risk

Small review surface and low semantic risk. Both facades and spans moved intact and still call the same module-owned SQL functions with the same pool, arguments, return types, and global-list semantics. The first-community provenance invariant remains unchanged and covered by native PostgreSQL.

Blox verification

Author workstation: buzz-tornquist-issue-2-store-stack (2046520), exact head c007b0fdf7e213c8a1120c65a37dbf999d2e320d.

• cargo fmt --all --check
• git diff --check 5a497a98cefd2dd531f8bde48b5b5ee2c4cb4362..HEAD
• cargo clippy -p buzz-db --all-targets -- -D warnings
• cargo clippy -p buzz-relay --all-targets -- -D warnings
• cargo test -p buzz-db --lib: 108 passed, 200 ignored
• cargo test -p buzz-db --test store_ownership: 15 passed
• cargo test -p buzz-db --test observability_source: 1 passed
• Native PostgreSQL 17.11, migrations 1–32 already applied: product-feedback provenance test passed
• cargo test -p buzz-relay --lib: 909 passed, 48 ignored
• Signed commit hooks passed

Independent exact-head Blox review: no findings. A separate clean workstation verified exact base/head geometry, byte-identical SQL/parsing/idempotency behavior, fixed-label single span ownership, formatting, diff hygiene, both clippy targets, 108 DB unit tests, 15 ownership guards, the observability guard, the PostgreSQL provenance test, an additional cross-community ordering probe, and 909 relay tests. Review artifacts were preserved before teardown.

Remaining tracker work

Next: moderation, then git registry and archived identities, usage/admin/maintenance, deletion ownership, and the final runtime-boundary audit.

Superseded pre-comment restack verification

PR #6700 merged before publication completed. This layer was restacked onto current main through the exact parent named above; the final cumulative tip is 2ddcc8a. Cumulative author gates passed: formatting and diff checks; buzz-db and buzz-relay all-target clippy with -D warnings; DB lib 111 passed / 200 ignored; ownership 22/22; observability 1/1; the full isolated PostgreSQL domain matrix; and relay lib 910 passed / 49 ignored.

Result

No findings.

Exact revision and isolation

• Base: dd7e3c290792b1a68cc73225af87a494ae35d271
• Head: 6ae5893c36429f778105285ce77fc890ad5e3c67
• Verified head parent and merge-base: exact base above
• Reviewer workstation: buzz-tornquist-pr-6806-final-review (2057662)

The fresh shallow workstation was clean and unclaimed, had no competing commands, and had no Buzz production relay credentials or ownership-report file.

Review conclusions

• The two product-feedback Db facades move unchanged into product_feedback.rs; public arguments, return types, delegation, idempotency, ordering, and error propagation remain compatible.
• Product-feedback SQL and row parsing are unchanged. Both fixed-label datastore spans retain their exact names and have one owner.
• The new guard proves the methods, spans, and public records are absent from lib.rs and singly owned by the domain module.

Verification

• git diff --check and cargo fmt --all --check: passed.
• cargo clippy -p buzz-db --all-targets -- -D warnings: passed.
• cargo clippy -p buzz-relay --all-targets -- -D warnings: passed.
• cargo test -p buzz-db --lib: 111 passed, 200 ignored.
• store_ownership: 15 passed; observability_source: 1 passed.
• Native PostgreSQL 17.11, migrations complete: focused product-feedback test 1 passed.
• Final detached head remained clean; no duplicate datastore-span names were found.

Artifacts: pr-6806-final-review-artifacts.tgz, SHA-256 12e1ee762615464189ec68494a42b90324c4b3b507b392ed2d421b66c3e6feb7. Archive and internal checksums were verified locally.

Comment-addressed restack

Review follow-up on #6777 removed only the low-value replaceable ownership source test. This PR was restacked onto its rewritten parent; its production patch is unchanged.

• Exact base: 849b81729ebbf0a92e755fea220187db4ed816ae
• Exact head: 64fa6de401a9a14f2aa5da3dd13beac19942a944
• Final cumulative tip: 6fa2f104d42c6ba85bdf62e7ccb74ceaf4a84f67
• Per-layer patch-ID and tree audits confirm this PR’s production diff is unchanged from its pre-comment head.
• Cumulative Blox gate: formatting and diff checks; strict buzz-db/buzz-relay Clippy; DB lib 111 passed / 200 ignored; ownership 21/21; observability 1/1; every moved PostgreSQL test; relay lib 910 passed / 49 ignored.
• Independent re-review at this exact head: no findings; fresh exact-parent/head Blox review passed fmt/diff, strict buzz-db/buzz-relay Clippy, DB lib and current ownership/observability/unique-span guards, 1 product-feedback PostgreSQL test, and relay compilation.