Add PHP 7.4+ type hints to helpers, models, and middleware

Added strict typing with parameter types, return types, and property
types across all core classes:
- helpers: Database, ErrorHandler, CacheHelper
- models: TicketModel, UserModel, WorkflowModel, TemplateModel, UserPreferencesModel
- middleware: RateLimitMiddleware, CsrfMiddleware, SecurityHeadersMiddleware

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

models/UserModel.php

@@ -3,18 +3,18 @@
  * UserModel - Handles user authentication and management
  */
 class UserModel {
-    private $conn;
-    private static $userCache = []; // ['key' => ['data' => ..., 'expires' => timestamp]]
-    private static $cacheTTL = 300; // 5 minutes
+    private mysqli $conn;
+    private static array $userCache = []; // ['key' => ['data' => ..., 'expires' => timestamp]]
+    private static int $cacheTTL = 300; // 5 minutes
 
-    public function __construct($conn) {
+    public function __construct(mysqli $conn) {
         $this->conn = $conn;
     }
 
     /**
      * Get cached user data if not expired
      */
-    private static function getCached($key) {
+    private static function getCached(string $key): ?array {
         if (isset(self::$userCache[$key])) {
             $cached = self::$userCache[$key];
             if ($cached['expires'] > time()) {
@@ -29,7 +29,7 @@ class UserModel {
     /**
      * Store user data in cache with expiration
      */
-    private static function setCached($key, $data) {
+    private static function setCached(string $key, array $data): void {
         self::$userCache[$key] = [
             'data' => $data,
             'expires' => time() + self::$cacheTTL
@@ -39,7 +39,7 @@ class UserModel {
     /**
      * Invalidate specific user cache entry
      */
-    public static function invalidateCache($userId = null, $username = null) {
+    public static function invalidateCache(?int $userId = null, ?string $username = null): void {
         if ($userId !== null) {
             unset(self::$userCache["user_id_$userId"]);
         }
@@ -57,7 +57,7 @@ class UserModel {
      * @param string $groups Comma-separated groups from Remote-Groups header
      * @return array User data array
      */
-    public function syncUserFromAuthelia($username, $displayName = '', $email = '', $groups = '') {
+    public function syncUserFromAuthelia(string $username, string $displayName = '', string $email = '', string $groups = ''): array {
         // Check cache first
         $cacheKey = "user_$username";
         $cached = self::getCached($cacheKey);
@@ -122,7 +122,7 @@ class UserModel {
      *
      * @return array|null System user data or null if not found
      */
-    public function getSystemUser() {
+    public function getSystemUser(): ?array {
         // Check cache first
         $cached = self::getCached('system');
         if ($cached !== null) {
@@ -150,7 +150,7 @@ class UserModel {
      * @param int $userId User ID
      * @return array|null User data or null if not found
      */
-    public function getUserById($userId) {
+    public function getUserById(int $userId): ?array {
         // Check cache first
         $cacheKey = "user_id_$userId";
         $cached = self::getCached($cacheKey);
@@ -180,7 +180,7 @@ class UserModel {
      * @param string $username Username
      * @return array|null User data or null if not found
      */
-    public function getUserByUsername($username) {
+    public function getUserByUsername(string $username): ?array {
         // Check cache first
         $cacheKey = "user_$username";
         $cached = self::getCached($cacheKey);
@@ -210,7 +210,7 @@ class UserModel {
      * @param string $groups Comma-separated group names
      * @return bool True if user is in admin group
      */
-    private function checkAdminStatus($groups) {
+    private function checkAdminStatus(string $groups): bool {
         if (empty($groups)) {
             return false;
         }
@@ -226,7 +226,7 @@ class UserModel {
      * @param array $user User data array
      * @return bool True if user is admin
      */
-    public function isAdmin($user) {
+    public function isAdmin(array $user): bool {
         return isset($user['is_admin']) && $user['is_admin'] == 1;
     }
 
@@ -237,7 +237,7 @@ class UserModel {
      * @param array $requiredGroups Array of required group names
      * @return bool True if user is in at least one required group
      */
-    public function hasGroupAccess($user, $requiredGroups = ['admin', 'employee']) {
+    public function hasGroupAccess(array $user, array $requiredGroups = ['admin', 'employee']): bool {
         if (empty($user['groups'])) {
             return false;
         }
@@ -253,7 +253,7 @@ class UserModel {
      *
      * @return array Array of user records
      */
-    public function getAllUsers() {
+    public function getAllUsers(): array {
         $stmt = $this->conn->prepare("SELECT * FROM users ORDER BY created_at DESC");
         $stmt->execute();
         $result = $stmt->get_result();
@@ -273,7 +273,7 @@ class UserModel {
      *
      * @return array Array of unique group names
      */
-    public function getAllGroups() {
+    public function getAllGroups(): array {
         $stmt = $this->conn->prepare("SELECT DISTINCT groups FROM users WHERE groups IS NOT NULL AND groups != ''");
         $stmt->execute();
         $result = $stmt->get_result();