Fix views/controllers/router: command palette, create form, admin views

- Consolidate the duplicated command palette to a single overlay + init in
  the footer; fix New Ticket to route to /ticket/create (was a 404 /create);
  keep the CSP nonce and all commands
- TicketController create(): trim title, require a non-empty description,
  and honor the posted status (validated against the canonical list) instead
  of silently discarding it
- UserActivityView: 'Active Users' counts only users active in the selected
  range, not every registered user
- layout_footer/DashboardView: local esc() now escapes quotes so values used
  in HTML attributes can't break out
- TicketView: comments tab badge shows the true total, not just page one
- layout_header: gate the 'View activity log' link behind the admin flag
- index.php: validate /admin/user-activity date params; anchor the legacy
  /ticket.php route; align the audit action-type whitelist with the dropdown
- ApiKeysView: correct the external API sample to /create_ticket_api.php

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

views/admin/AuditLogView.php

@@ -29,9 +29,14 @@ include __DIR__ . '/../../views/layout_header.php';
         <label class="lt-label" for="action_type">Action Type</label>
         <select name="action_type" id="action_type" class="lt-select lt-select-sm">
           <option value="">All Actions</option>
-          <?php foreach (['create','update','delete','comment','assign','status_change','login','security'] as $a) : ?>
+          <?php
+            // Mirrors AuditLogModel::VALID_ACTION_TYPES (the backend whitelist of loggable actions)
+            $auditActionTypes = ['create','update','delete','view','security_event',
+                                 'login','logout','assign','unassign','comment','mention',
+                                 'revoke','attachment_upload','attachment_delete','bulk_update'];
+            foreach ($auditActionTypes as $a) : ?>
             <option value="<?= htmlspecialchars($a, ENT_QUOTES, 'UTF-8') ?>" <?= ($filters['action_type'] ?? '') === $a ? 'selected' : '' ?>><?= htmlspecialchars(ucfirst(str_replace('_', ' ', $a)), ENT_QUOTES, 'UTF-8') ?></option>
-          <?php endforeach ?>
+            <?php endforeach ?>
         </select>
       </div>
       <div class="lt-form-group" style="margin:0">