Fix views/controllers/router: command palette, create form, admin views

- Consolidate the duplicated command palette to a single overlay + init in
  the footer; fix New Ticket to route to /ticket/create (was a 404 /create);
  keep the CSP nonce and all commands
- TicketController create(): trim title, require a non-empty description,
  and honor the posted status (validated against the canonical list) instead
  of silently discarding it
- UserActivityView: 'Active Users' counts only users active in the selected
  range, not every registered user
- layout_footer/DashboardView: local esc() now escapes quotes so values used
  in HTML attributes can't break out
- TicketView: comments tab badge shows the true total, not just page one
- layout_header: gate the 'View activity log' link behind the admin flag
- index.php: validate /admin/user-activity date params; anchor the legacy
  /ticket.php route; align the audit action-type whitelist with the dropdown
- ApiKeysView: correct the external API sample to /create_ticket_api.php

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

controllers/TicketController.php

@@ -93,19 +93,27 @@ class TicketController
                 $visibilityGroups = implode(',', array_map('trim', $_POST['visibility_groups']));
             }
 
+            // Honor the posted status, validated against the app's canonical list
+            $validStatuses = $GLOBALS['config']['TICKET_STATUSES'] ?? ['Open', 'Pending', 'In Progress', 'Closed'];
+            $status = $_POST['status'] ?? 'Open';
+            if (!in_array($status, $validStatuses, true)) {
+                $status = 'Open';
+            }
+
             $ticketData = [
-                'title' => $_POST['title'] ?? '',
+                'title' => trim($_POST['title'] ?? ''),
                 'description' => $_POST['description'] ?? '',
                 'priority' => $_POST['priority'] ?? '4',
                 'category' => $_POST['category'] ?? 'General',
                 'type' => $_POST['type'] ?? 'Issue',
+                'status' => $status,
                 'visibility' => $_POST['visibility'] ?? 'public',
                 'visibility_groups' => $visibilityGroups,
                 'assigned_to' => !empty($_POST['assigned_to']) ? $_POST['assigned_to'] : null
             ];
 
-            // Validate input
-            if (empty($ticketData['title'])) {
+            // Validate input (server-side; form is novalidate)
+            if ($ticketData['title'] === '') {
                 $error = "Title is required";
                 $templates = $this->templateModel->getAllTemplates();
                 $allUsers = $this->userModel->getAllUsers();
@@ -114,6 +122,15 @@ class TicketController
                 return;
             }
 
+            if (trim($ticketData['description']) === '') {
+                $error = "Description is required";
+                $templates = $this->templateModel->getAllTemplates();
+                $allUsers = $this->userModel->getAllUsers();
+                $conn = $this->conn; // Make $conn available to view
+                include dirname(__DIR__) . '/views/CreateTicketView.php';
+                return;
+            }
+
             // Create ticket with user tracking
             $result = $this->ticketModel->createTicket($ticketData, $userId);