feat: report a problem from Settings, judged before it becomes a GitHub issue

[JoseEstevez520]

People can now report a problem from Settings. A model reads the report, throws out spam, rewrites it without personal details, checks the open issues for a duplicate, and files an issue or comments on the existing one.

What's in it:

• API. A bug_reports table (migration 0038) and POST /bugs, GET /bugs/mine, and for admins GET /bugs, POST /bugs/{id}/file and POST /bugs/{id}/discard. The report is saved before it's judged, so a model or GitHub failure loses nothing. A person can send 5 a day (BUG_REPORT_DAILY_LIMIT), admins have no cap.
• Web. One quiet row in Settings that opens a window with the form and your reports. Admins get a second row with every report in the organization, and a switch to share reports with the SkillNet team.
• Relay. apps/skillnet-relay is a small service that receives reports from any instance and files them with its own GitHub token, so the token never lives in an instance or in the code. It limits reports per address, per instance and per day, and it judges every report itself rather than trusting the instance. It has its own Dockerfile (docker/relay.Dockerfile).

Sharing with the team is off by default and only the admin can turn it on. Only the title, the text, the page and the browser are sent, never a name, an email or an organization. If the relay can't be reached, the instance judges the report itself, so sharing never costs a report. With no GITHUB_TOKEN and GITHUB_REPO nothing leaves the deployment.

I also tied Textarea's label to its field, the way Input already does.

Testing:

• API: 20 new tests; the unit suite passes except test_llm_client.py::test_a_model_whose_thinking_is_opt_in_is_left_alone, which fails the same way on main and develop.
• Relay: 17 tests, plus the image built and run against DeepSeek and GitHub.
• Web: 1044 tests pass, lint and build are clean.
• End to end on a local Postgres: an instance with sharing on sent a report to the relay, which opened a real issue (closed afterwards).

Not done yet: deploying the relay and pointing reports.skillnet.es at it. Until then the switch has nothing to send to, and reports fall back to being judged in the instance.