chore: remove decommissioned feedback.profullstack.com widget

[ralyodio]

The Profullstack feedback widget (feedback.profullstack.com) has been decommissioned.

This removes every trace:

• FeedbackWidget embed + import from apps/web/src/app/layout.tsx
• https://feedback.profullstack.com from the script-src and frame-src CSP directives in apps/web/next.config.ts (frame-src is now just 'self')
• the privacy-policy entry for the feedback widget in apps/web/src/app/privacy/page.tsx
• stale comment mention of the feedback widget

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

17 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 8 | LOW: 8

Severity	Rule	Location
HIGH	secret-aws-access-key	prd/0003-detect-hardcoded-secrets-before-they-are-committed-or-served.md:126
MEDIUM	sql-string-concatenation	.github/workflows/migrate-dev2.yml:128
MEDIUM	js-open-redirect	apps/web/src/app/auth/login/page.tsx:67
MEDIUM	js-unescaped-html-sink	apps/web/src/app/hire/page.tsx:104
MEDIUM	js-unescaped-html-sink	apps/web/src/app/hire/page.tsx:108
MEDIUM	js-open-redirect	apps/web/src/app/invite/[token]/invite-client.tsx:55
MEDIUM	js-open-redirect	apps/web/src/components/funding/FundingClient.tsx:97
MEDIUM	js-unescaped-html-sink	apps/web/src/components/GuideReader.tsx:265
MEDIUM	js-uninitialized-buffer	packages/scan/src/node-rules.ts:456
LOW	secret-generic-credential	apps/web/src/app/api/auth/refresh/route.ts:17
LOW	secret-generic-credential	apps/web/src/app/api/auth/reset-password/route.ts:26
LOW	secret-generic-credential	apps/web/src/app/api/auth/reset-password/route.ts:27
LOW	secret-generic-credential	PRD.md:269
LOW	tls-verification-disabled	prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:121
LOW	tls-verification-disabled	prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:122
LOW	sh-remote-script-execution	scripts/smoke-test.sh:72
LOW	secret-aws-access-key	scripts/smoke-test.sh:150

Snippets are redacted; ThreatCrush never prints matched credential material.