Fix views/controllers/router: command palette, create form, admin views

- Consolidate the duplicated command palette to a single overlay + init in
  the footer; fix New Ticket to route to /ticket/create (was a 404 /create);
  keep the CSP nonce and all commands
- TicketController create(): trim title, require a non-empty description,
  and honor the posted status (validated against the canonical list) instead
  of silently discarding it
- UserActivityView: 'Active Users' counts only users active in the selected
  range, not every registered user
- layout_footer/DashboardView: local esc() now escapes quotes so values used
  in HTML attributes can't break out
- TicketView: comments tab badge shows the true total, not just page one
- layout_header: gate the 'View activity log' link behind the admin flag
- index.php: validate /admin/user-activity date params; anchor the legacy
  /ticket.php route; align the audit action-type whitelist with the dropdown
- ApiKeysView: correct the external API sample to /create_ticket_api.php

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

views/admin/ApiKeysView.php

@@ -132,7 +132,7 @@ include __DIR__ . '/../../views/layout_header.php';
     </p>
     <div class="lt-code-block">
       <div class="lt-code-header"><span class="lt-code-lang">CURL</span></div>
-      <pre><code>curl -X POST https://your-instance/api/create_ticket.php \
+      <pre><code>curl -X POST https://your-instance/create_ticket_api.php \
   -H "Authorization: Bearer YOUR_API_KEY" \
   -H "Content-Type: application/json" \
   -d '{"title":"My ticket","category":"General","type":"Issue","priority":3}'</code></pre>

views/admin/AuditLogView.php

@@ -29,9 +29,14 @@ include __DIR__ . '/../../views/layout_header.php';
         <label class="lt-label" for="action_type">Action Type</label>
         <select name="action_type" id="action_type" class="lt-select lt-select-sm">
           <option value="">All Actions</option>
-          <?php foreach (['create','update','delete','comment','assign','status_change','login','security'] as $a) : ?>
+          <?php
+            // Mirrors AuditLogModel::VALID_ACTION_TYPES (the backend whitelist of loggable actions)
+            $auditActionTypes = ['create','update','delete','view','security_event',
+                                 'login','logout','assign','unassign','comment','mention',
+                                 'revoke','attachment_upload','attachment_delete','bulk_update'];
+            foreach ($auditActionTypes as $a) : ?>
             <option value="<?= htmlspecialchars($a, ENT_QUOTES, 'UTF-8') ?>" <?= ($filters['action_type'] ?? '') === $a ? 'selected' : '' ?>><?= htmlspecialchars(ucfirst(str_replace('_', ' ', $a)), ENT_QUOTES, 'UTF-8') ?></option>
-          <?php endforeach ?>
+            <?php endforeach ?>
         </select>
       </div>
       <div class="lt-form-group" style="margin:0">

views/admin/UserActivityView.php

@@ -43,11 +43,23 @@ include __DIR__ . '/../../views/layout_header.php';
 
     <!-- Summary stats -->
     <?php if (!empty($userStats)) : ?>
+        <?php
+        // "Active" = users with >=1 tracked action within the selected date range.
+        // The query LEFT JOINs from all users, so $userStats includes zero-activity users.
+        $activeUsers = 0;
+        foreach ($userStats as $_u) {
+            $_activity = ($_u['tickets_created'] ?? 0) + ($_u['tickets_resolved'] ?? 0)
+                + ($_u['comments_added'] ?? 0) + ($_u['tickets_assigned'] ?? 0);
+            if ($_activity > 0) {
+                $activeUsers++;
+            }
+        }
+        ?>
     <div class="lt-stats-grid lt-mb-md">
       <div class="lt-stat-card">
         <div class="lt-stat-icon lt-text-cyan">[ # ]</div>
         <div class="lt-stat-info">
-          <div class="lt-stat-value"><?= count($userStats) ?></div>
+          <div class="lt-stat-value"><?= (int)$activeUsers ?></div>
           <div class="lt-stat-label">Active Users</div>
         </div>
       </div>