Hardening: input validation and boundary guards in database feedback #19891

Problem

In backend/database/feedback.py:

• record_feedback_event accepted raw unvalidated uid and target_id strings, potentially persisting blank whitespace strings into Firestore documents.
• _idempotent_event_id hashed f'{uid}:{feedback_id}' without normalization; leading/trailing whitespace variances across retries would result in differing SHA-256 hashes for logically identical actions.
• Document lookup functions (get_feedback_event, get_report) did not validate argument types/blank strings before calling Firestore collection .document(...).
• backend/routers/mobile_feedback.py did not explicitly catch database ValueError exceptions and map them to HTTP 400.

Proposed Solution

1. Validate and strip whitespace for uid and target_id in write operations.
2. Ensure hash parity across write and replay paths by normalizing uid and feedback_id in _idempotent_event_id.
3. Guard get_feedback_event, get_report, save_report, and list_negative_events against invalid arguments and boundary conditions.
4. Catch ValueError in submit_mobile_feedback and return HTTPException(status_code=400, detail=str(exc)).
5. Add comprehensive hermetic unit tests.

References

• PR: fix(backend): validate inputs and add boundary guards in database feedback #19890
• Proposed Bounty: $50 USD
• Settlement: Base USDC 0xbB9686b9684421A8e326AC0F8B3eCf88Df975120