feat(self-host): deliver feedback to the instance operator - #90

Summary

• Add an optional self-host operator feedback webhook, independent of usage analytics. EXECUTOR_FEEDBACK_WEBHOOK_URL and optional EXECUTOR_FEEDBACK_WEBHOOK_SECRET configure delivery; no setting preserves existing analytics/disabled behavior.
• Await a 2xx response, bound delivery to 10 seconds, refuse redirects, and return sanitized FeedbackUnavailable on failure. Include submission time, organization, authenticated user/email, available caller attribution and instance origin. Generic title/body support notification receivers without another service.
• Keep the production change isolated to a new self-host module and its route wiring. No schema migration; receiver owns retention. Update operator/agent docs and keep the fork's CI running the focused scenarios.

Verification

• Five focused real self-host scenarios passed: both new webhook cases, analytics fallback, analytics opt-out, and hosted feedback contract.
• Covers bearer set/unset, analytics off, rejection, timeout, redirect refusal, no early acceptance, API/app caller attribution and secret-free server logs.
• Mutation check: temporarily accepting receiver failures made the test fail (expected 503, got 200); reverted.
• bun run check, actionlint, and the packaged-image regression passed on 512237ad62b57c1f6ce130dea138f3652124788a.
• New named Docker scenario: released image delivers operator feedback with analytics disabled (run via e2e/docker-release.config.ts, not the normal self-host suite).
• Opus review found workerd rejects redirect: "error"; fixed to manual, added native-image regression coverage and addressed the nonblocking docs/logging/origin/test findings. Native-image verification passed: actual Go/workerd product accepted the attributed payload with analytics off and refused redirects and 503 responses. No remaining known review finding.

Deployment

Own fork only. Live image currently has no PostHog destination and no webhook, so feedback is disabled rather than reaching upstream. A persistent SHark receiver has been created with its URL stored privately; production wiring/deployment follows green CI. No ports, firewall, network, allowlist or tunnel changes.

feedback-webhook.spec.ts
feedback.spec.ts
instance-analytics.spec.ts