Fix views/controllers/router: command palette, create form, admin views

- Consolidate the duplicated command palette to a single overlay + init in
  the footer; fix New Ticket to route to /ticket/create (was a 404 /create);
  keep the CSP nonce and all commands
- TicketController create(): trim title, require a non-empty description,
  and honor the posted status (validated against the canonical list) instead
  of silently discarding it
- UserActivityView: 'Active Users' counts only users active in the selected
  range, not every registered user
- layout_footer/DashboardView: local esc() now escapes quotes so values used
  in HTML attributes can't break out
- TicketView: comments tab badge shows the true total, not just page one
- layout_header: gate the 'View activity log' link behind the admin flag
- index.php: validate /admin/user-activity date params; anchor the legacy
  /ticket.php route; align the audit action-type whitelist with the dropdown
- ApiKeysView: correct the external API sample to /create_ticket_api.php

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

views/TicketView.php

@@ -461,8 +461,8 @@ include __DIR__ . '/layout_header.php';
   <button type="button" class="lt-tab" id="comments-tab-btn"
           role="tab" data-tab="comments-panel" aria-selected="false" aria-controls="comments-panel">
     Comments
-    <?php if (!empty($comments)) : ?>
-      <span class="lt-badge lt-badge-sm"><?= count($comments) ?></span>
+    <?php if ($totalComments > 0) : ?>
+      <span class="lt-badge lt-badge-sm"><?= (int)$totalComments ?></span>
     <?php endif ?>
   </button>
   <button type="button" class="lt-tab" id="attachments-tab-btn"