feat(suggestions): full suggestion workflow with per-step notes

DB migration h5c6d7e8f9a0:
- Extends tdstatus enum: submitted → analyse → plan → implement →
  test → review → finished (+ wont_fix remains)
- New td_notes table: td_id FK (CASCADE), step, author, content, created_at

API:
- TDNote model + TDNoteCreate/TDNoteRead schemas
- TDRead includes notes[] (selectin loaded)
- New routes: GET/POST /technical-debt/{id}/notes/
- list_td status filter accepts str (all enum values)

Modal: new submissions use status="submitted" instead of "open"

UI Feedback page revamp:
- Visual step-by-step stepper (submitted→analyse→plan→implement→test→review→finished)
- Per-step notes: view all notes, add note inline
- Action buttons: advance to next step, won't fix
- Review step highlighted as awaiting original suggester confirmation
- Closed items (finished/wont_fix) shown with last 2 notes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/routers/technical_debt.py

@@ -6,8 +6,8 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from api.database import get_session
 from api.models.domain import Domain
-from api.models.technical_debt import TDStatus, TechnicalDebt
-from api.schemas.technical_debt import TDCreate, TDRead, TDUpdate
+from api.models.technical_debt import TDNote, TDStatus, TechnicalDebt
+from api.schemas.technical_debt import TDCreate, TDNoteCreate, TDNoteRead, TDRead, TDUpdate
 
 router = APIRouter(prefix="/technical-debt", tags=["technical-debt"])
 
@@ -32,7 +32,7 @@ async def _resolve_domain_id(slug: str, session: AsyncSession) -> uuid.UUID:
 @router.get("/", response_model=list[TDRead])
 async def list_td(
     domain: str | None = None,
-    status: TDStatus | None = None,
+    status: str | None = None,         # str to accept both legacy and workflow values
     debt_type: str | None = None,
     severity: str | None = None,
     session: AsyncSession = Depends(get_session),
@@ -106,3 +106,35 @@ async def defer_td(
     await session.commit()
     await session.refresh(td)
     return td
+
+
+# ── Notes ─────────────────────────────────────────────────────────────────────
+
+@router.get("/{td_id}/notes/", response_model=list[TDNoteRead])
+async def list_notes(
+    td_id: uuid.UUID,
+    session: AsyncSession = Depends(get_session),
+) -> list[TDNote]:
+    td = await session.get(TechnicalDebt, td_id)
+    if td is None:
+        raise HTTPException(status_code=404, detail="Technical debt item not found")
+    result = await session.execute(
+        select(TDNote).where(TDNote.td_id == td_id).order_by(TDNote.created_at)
+    )
+    return list(result.scalars().all())
+
+
+@router.post("/{td_id}/notes/", response_model=TDNoteRead, status_code=status.HTTP_201_CREATED)
+async def add_note(
+    td_id: uuid.UUID,
+    body: TDNoteCreate,
+    session: AsyncSession = Depends(get_session),
+) -> TDNote:
+    td = await session.get(TechnicalDebt, td_id)
+    if td is None:
+        raise HTTPException(status_code=404, detail="Technical debt item not found")
+    note = TDNote(td_id=td_id, **body.model_dump())
+    session.add(note)
+    await session.commit()
+    await session.refresh(note)
+    return note