Wire feedback to IIS reverse-proxy -> Power Automate

- Set FEEDBACK_ENDPOINT to same-origin /api/feedback (no CORS, hides trigger URL)
- Add web.config with ARR/URL-Rewrite proxy rule (placeholder trigger URL),
  HTTPS/POST/static-content setup
- DEPLOYMENT.md: concrete IIS + Power Automate steps and the HTTP-trigger
  Request Body JSON Schema matching the app payload

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feedback-config.js

@@ -15,8 +15,14 @@
 
    Leave it as an empty string to stay fully local (export/import only).
    See DEPLOYMENT.md for setup details and sample receivers.
+
+   This is set to the same-origin path '/api/feedback', which the IIS reverse
+   proxy (see web.config) forwards to the Power Automate HTTP trigger. Keeping it
+   relative means no CORS and the secret trigger URL never appears in client
+   code. Locally (no proxy) the POST simply fails silently and feedback is still
+   saved/exported from the browser.
    ────────────────────────────────────────────────────────────────────────── */
-window.FEEDBACK_ENDPOINT = '';
+window.FEEDBACK_ENDPOINT = '/api/feedback';
 
 /* Best-effort send to the central endpoint. Never throws and never blocks the
    UI: feedback is always saved locally first by the caller, so a failed or