fix(lens): block teamless feedback writes and fix retention test

[ishaan-berri]

Relevant issues

Follow-up to #45171, which merged before these fixes landed.

Pre-Submission checklist

• I have added meaningful tests
• The handful of test files covering my change pass locally
• My PR passes all required CI/CD checks
• My PR's scope is as isolated as possible; it only solves 1 specific problem

Type

🐛 Bug Fix

Changes

• Security (Veria finding on feat(lens): show end-user feedback on traces, stored in ClickHouse #45171): a non-admin JWT caller with no team and no key token got Scope(team_id="", api_key_hash=""), which the feedback target query treats as a wildcard. They could overwrite or delete another key's feedback on a teamless trace. write_scope now returns 403 for that case. New test test_a_caller_without_a_team_or_key_cannot_write_on_a_teamless_trace fails without the fix.
• rust-wheel CI: test_schema_setup_uses_configured_retention now expects the lens_feedback TTL statement that feat(lens): show end-user feedback on traces, stored in ClickHouse #45171 added.
• Greptile nits from feat(lens): show end-user feedback on traces, stored in ClickHouse #45171: split the two-for comprehension in feedback_repository.py (LIT014) and in the test fake, and dropped four routine doc comments in the Lens UI.

The misc / proxy-infra-root failures on #45171 came from Moyai (#45196). Main already fixed them in #45220. The rust-test failure was the CI runner's linker crashing (ld terminated with signal 7 [Bus error]), not a test.

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Feedback write access control and test fixes.

The PR appears safe to merge, with no actionable issues found

What we checked:

• Teamless feedback stays protected: Both write routes call write_scope before changing feedback. It now rejects this caller before the query can treat an empty key as a wildcard
• Retention test matches setup: Schema setup applies migrations first, then sends four retention statements in the same order the test expects

Summary

Blocks non-admin feedback writes when the caller has neither a team nor an API key

• Adds a regression test covering overwrite and delete attempts on a teamless trace
• Updates the retention test to include lens_feedback
• Simplifies summary comprehensions and removes routine UI comments
• No actionable issues found. Tests were inspected, not run

_{Reviews (1) · Last reviewed commit: "chore(lens-ui): drop routine comment on ..." · Reviewed by Greptile}

[codspeed]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_lens_feedback_followup (854f0c4) with main (03ba79d)}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!