feat(agent): add index bootstrap and answer feedback

tests/test_api.py

@@ -91,6 +91,7 @@ def test_frontend_assets_use_v1_api_and_unknown_assets_are_hidden():
         assert script.status_code == 200
         assert styles.status_code == 200
         assert 'fetch("/v1/ask"' in script.text
+        assert 'fetch("/v1/ratings"' in script.text
         assert "innerHTML" not in script.text
         assert missing.status_code == 404
 
@@ -172,6 +173,47 @@ def test_v1_extracts_grounded_conflict_and_clarification(monkeypatch):
         assert body["alternatives"] == []
 
 
+def test_v1_rating_is_persisted_for_logged_answer(monkeypatch, tmp_path):
+    monkeypatch.setattr("agent.api.answer_question", lambda *args, **kwargs: answer_result())
+    with TestClient(app) as client:
+        app.state.rag.cfg = Config(
+            api_key="service-secret",
+            audit_enabled=True,
+            audit_db_path=str(tmp_path / "audit.db"),
+        )
+        app.state.rag.client = FakeClient()
+        app.state.rag.retriever = FakeRetriever()
+        headers = {
+            "Authorization": "Bearer service-secret",
+            "X-Request-ID": "rated-answer-1",
+        }
+        answer = client.post("/v1/ask", json={"question": "Was gilt?"}, headers=headers)
+        assert answer.status_code == 200
+        assert answer.json()["ratings_enabled"] is True
+
+        rating = client.post(
+            "/v1/ratings",
+            json={
+                "request_id": "rated-answer-1",
+                "rating": "up",
+                "feedback": "Hilfreich und nachvollziehbar",
+            },
+            headers={"Authorization": "Bearer service-secret"},
+        )
+        assert rating.status_code == 200
+        assert rating.json()["accepted"] is True
+        row = app.state.rag.audit.recent()[0]
+        assert row["rating"] == "up"
+        assert row["feedback"] == "Hilfreich und nachvollziehbar"
+
+        missing = client.post(
+            "/v1/ratings",
+            json={"request_id": "missing-answer", "rating": "down"},
+            headers={"Authorization": "Bearer service-secret"},
+        )
+        assert missing.status_code == 404
+
+
 def test_health_does_not_expose_internal_ollama_url():
     with TestClient(app) as client:
         configure_state(api_key="service-secret")