feat(diagnostics): send a bug report to a private Gitea issue tracker (E16 S4)

- admin config group "Bug reports": Gitea address, repository, token (secret),
  and "Check the connection" — the repository must answer, take issues and
  be PRIVATE (a report carries its reporter's log); checked on every send too
- POST /api/debug-sessions/{id}/issue sends the SAVED draft: create the issue,
  upload each file on its own request (the measured API), then show the
  screenshots inline; progress is kept in the draft, so a send that stops
  half-way keeps its issue and the retry sends only what is missing; 5 new
  issues an hour per user; audited as issue_create
- the composer: Create issue (only where a tracker is set up, naming the
  repository), a partial-send banner with retry, and a Preview — the tracker's
  own rendering in a sandboxed frame, or the zip's markdown without one
- the recorder's refusals answer in the localized family (debug_session_*,
  screenshot_*, issue(s)_*), not bare codes the UI could only call generic
- a tracker refusal logs the status only: its message can quote the title back

frontend/src/lib/api/account.ts

@@ -35,6 +35,8 @@ export interface Me {
   diagnostics: DiagnosticsState;
   /** The debug session recording right now, if any (E16) — a reload resumes it. */
   debug_session: DebugSession | null;
+  /** Where a bug report goes — the tracker's repository — or null: download only (E16 S4). */
+  issues: { repo: string } | null;
 }
 
 /** The `nav.role.*` key an account is shown under. Demo isn't a real role (it's a flag on a `user`

frontend/src/lib/api/admin.ts

@@ -244,6 +244,9 @@ export const adminApi = {
     req(`/api/admin/config/${key}`, { method: "DELETE" }),
   testEmail: (): Promise<{ sent: boolean; to: string }> =>
     req("/api/admin/config/test-email", { method: "POST" }),
+  /** The bug-report tracker (E16): answers, takes issues, and is private. */
+  testIssues: (): Promise<{ ok: true; repo: string; url: string | null }> =>
+    req("/api/admin/config/test-issues", { method: "POST" }),
   // --- users & roles ---
   adminAudit: (limit = 500): Promise<AuditListResult> => req(`/api/admin/audit?limit=${limit}`),
   clearAudit: (): Promise<{ cleared: number }> => req("/api/admin/audit", { method: "DELETE" }),

frontend/src/lib/api/diagnostics.ts

@@ -53,6 +53,8 @@ export interface DebugSession {
   ended_reason: "stopped" | "expired" | null;
   /** The issue it was sent as, once sent. */
   issue_url: string | null;
+  /** Files a send that stopped half-way has still to deliver (retrying sends only these). */
+  pending_files: string[];
   screenshots: number;
   /** The issue being written from it (the composer saves as it goes); null until it first does. */
   draft: DebugDraft | null;
@@ -107,6 +109,12 @@ export const debugSessionsApi = {
     const url = `${SESSIONS}/${id}/export`;
     return a != null ? `${url}?account=${a}` : url;
   },
+  /** Send the SAVED draft to the issue tracker, or finish a send that stopped half-way. */
+  sendDebugIssue: (id: string): Promise<{ ok: true; session: DebugSession }> =>
+    req(`${SESSIONS}/${id}/issue`, { method: "POST" }),
+  /** The body as the tracker renders it (sanitised HTML — shown in a sandboxed frame only). */
+  previewDebugIssue: (id: string, text: string): Promise<{ ok: true; html: string }> =>
+    req(`${SESSIONS}/${id}/preview`, { method: "POST", body: JSON.stringify({ text }) }),
   removeDebugScreenshot: (id: string, shotId: number): Promise<{ ok: true; deleted: number }> =>
     req(`${SESSIONS}/${id}/screenshots/${shotId}`, { method: "DELETE" }),
   /** Where an `<img>` loads a screenshot from. An `<img>` cannot send the account header, so the