Wire feedback to IIS reverse-proxy -> Power Automate

- Set FEEDBACK_ENDPOINT to same-origin /api/feedback (no CORS, hides trigger URL)
- Add web.config with ARR/URL-Rewrite proxy rule (placeholder trigger URL),
  HTTPS/POST/static-content setup
- DEPLOYMENT.md: concrete IIS + Power Automate steps and the HTTP-trigger
  Request Body JSON Schema matching the app payload

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web.config

@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  IIS configuration for the Work Package Suite (static site) + feedback proxy.
+
+  PREREQUISITES (one-time, done by the server admin in IIS Manager):
+    1. Install the "URL Rewrite" module.
+    2. Install "Application Request Routing" (ARR).
+    3. Enable the proxy: IIS Manager > (server node) >
+       Application Request Routing Cache > Server Proxy Settings >
+       check "Enable proxy". (This is server-level and cannot be set here.)
+    4. Bind the site to HTTPS with an internal certificate.
+
+  THEN: replace POWER_AUTOMATE_TRIGGER_URL below with the real "When an HTTP
+  request is received" URL from your flow. Remember every literal "&" in the URL
+  must be written as "&amp;" inside this file.
+-->
+<configuration>
+  <system.webServer>
+
+    <!-- index.html is the entry point -->
+    <defaultDocument>
+      <files>
+        <clear />
+        <add value="index.html" />
+      </files>
+    </defaultDocument>
+
+    <!-- Don't list folder contents -->
+    <directoryBrowse enabled="false" />
+
+    <rewrite>
+      <rules>
+        <!-- Forward same-origin /api/feedback POSTs to the Power Automate flow.
+             The browser sees only /api/feedback; the secret trigger URL stays
+             on the server. Requires ARR proxy enabled (see prerequisites). -->
+        <rule name="Feedback proxy to Power Automate" stopProcessing="true">
+          <match url="^api/feedback/?$" />
+          <action type="Rewrite"
+            url="POWER_AUTOMATE_TRIGGER_URL" />
+        </rule>
+      </rules>
+    </rewrite>
+
+    <!-- Make sure POST is allowed and the JSON body isn't truncated -->
+    <security>
+      <requestFiltering>
+        <verbs>
+          <add verb="POST" allowed="true" />
+        </verbs>
+        <!-- 1 MB cap on a feedback body is plenty -->
+        <requestLimits maxAllowedContentLength="1048576" />
+      </requestFiltering>
+    </security>
+
+    <!-- Sensible static MIME types (most are built in; this is belt-and-braces) -->
+    <staticContent>
+      <remove fileExtension=".json" />
+      <mimeMap fileExtension=".json" mimeType="application/json" />
+    </staticContent>
+
+  </system.webServer>
+</configuration>