Add a "report incorrect information" form to activity pages

[GreerBK]

What this adds

Every activity page now has a quiet "See something incorrect or out of date? Let us know." button at the bottom. It expands into a short form — what's wrong plus an optional email for a reply — and submissions are filed straight into a new Reports table in Airtable, linked to the activity, with Status = New.

The Reports table already exists in your base (created during this session, with a linked "Reports" column visible on Activities rows). Your review loop: open Reports → read the New rows → fix the linked activity (and bump its Last Verified date) → set the report to Fixed.

Safety & abuse protection

• Writes use a separate, write-capable Airtable token (AIRTABLE_WRITE_PAT). The site's main token stays read-only. Until you add the new token, the form degrades gracefully ("Reporting is not set up yet").
• Hidden honeypot field — bots that fill it get a fake success and nothing is saved.
• 2,000-character message cap, 10 KB request cap, control characters stripped, email format checked, non-POST requests rejected.
• The endpoint verifies the reported activity exists and is Active before saving, so junk IDs and unlisted records are rejected.

Verified locally against the real stack

Validation paths (bad ID, short message, bad email, oversized body) all return friendly 400s; honeypot returns a decoy success; with no write token the endpoint returns its graceful 503; with a read-only token the upstream rejection maps to a clean 502. A record with the exact payload shape was created in the live Reports table and deleted again — every field (linked activity, Status choice, timestamp) accepted. The form was exercised in a real browser: focus management, error state (visitor's text preserved), and success state all work; console is clean; npm run build passes.

To make it live (after merging) — two things only you can do

1. Create the write token and add it to Cloudflare.
   • Airtable → your account icon → Developer Hub → Personal access tokens → Create token. Name it e.g. mnparkinsons-reports-write, add scopes data.records:read and data.records:write, and under Access pick only your MN Parkinson's base. Copy the token.
   • Cloudflare → Workers & Pages → mnparkinsons → Settings → Variables and Secrets → add AIRTABLE_WRITE_PAT with that value, for Production and Preview (same dance as before).
   • Redeploy (Deployments → ⋯ → Retry deployment, or just push/merge anything).
2. Email notifications (optional but recommended): in Airtable → Automations → create → trigger "When a record is created" in Reports → action "Send email" to yourself → turn it on. About four clicks, same idea as your geocode automation.

Branch note

This PR is based on claude/zealous-hugle-2aaccb (PR #22), so it shows only the report feature. Merge #22 first; once its branch is deleted, GitHub automatically points this PR at main.

🤖 Generated with Claude Code