Instar canonical feedback receiver front — Phase 0 (no-traffic). Endpoints: /api/health, /api/feedback (POST, HMAC-signed).