Add performance, security, and reliability improvements

- Consolidate all 20 API files to use centralized Database helper
- Add optimistic locking to ticket updates to prevent concurrent conflicts
- Add caching to StatsModel (60s TTL) for dashboard performance
- Add health check endpoint (api/health.php) for monitoring
- Improve rate limit cleanup with cron script and efficient DirectoryIterator
- Enable rate limit response headers (X-RateLimit-*)
- Add audit logging for workflow transitions
- Log Discord webhook failures instead of silencing
- Fix visibility check on export_tickets.php
- Add database migration system with performance indexes
- Fix cron recurring tickets to use assignTicket method

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

middleware/RateLimitMiddleware.php

@@ -96,17 +96,58 @@ class RateLimitMiddleware {
 
     /**
      * Clean up old rate limit files (call periodically)
+     *
+     * Uses DirectoryIterator instead of glob() for better memory efficiency.
+     * A dedicated cron script (cron/cleanup_ratelimit.php) should also run for reliable cleanup.
      */
     public static function cleanupOldFiles(): void {
         $dir = self::getRateLimitDir();
-        $files = glob($dir . '/*.json');
+        $lockFile = $dir . '/.cleanup.lock';
         $now = time();
         $maxAge = self::WINDOW_SECONDS * 2; // Files older than 2 windows
+        $maxLockAge = 60; // Release stale locks after 60 seconds
 
-        foreach ($files as $file) {
-            if ($now - filemtime($file) > $maxAge) {
-                @unlink($file);
+        // Check for existing lock to prevent concurrent cleanups
+        if (file_exists($lockFile)) {
+            $lockAge = $now - filemtime($lockFile);
+            if ($lockAge < $maxLockAge) {
+                return; // Cleanup already in progress
             }
+            @unlink($lockFile); // Stale lock
+        }
+
+        // Try to acquire lock
+        if (!@touch($lockFile)) {
+            return;
+        }
+
+        try {
+            $iterator = new DirectoryIterator($dir);
+            $deleted = 0;
+            $maxDeletes = 50; // Limit deletions per request to avoid blocking
+
+            foreach ($iterator as $file) {
+                if ($deleted >= $maxDeletes) {
+                    break; // Let cron handle the rest
+                }
+
+                if ($file->isDot() || !$file->isFile()) {
+                    continue;
+                }
+
+                $filename = $file->getFilename();
+                if ($filename === '.cleanup.lock' || !str_ends_with($filename, '.json')) {
+                    continue;
+                }
+
+                if ($now - $file->getMTime() > $maxAge) {
+                    if (@unlink($file->getPathname())) {
+                        $deleted++;
+                    }
+                }
+            }
+        } finally {
+            @unlink($lockFile);
         }
     }
 
@@ -163,10 +204,12 @@ class RateLimitMiddleware {
      * Apply rate limiting and send error response if exceeded
      *
      * @param string $type 'default' or 'api'
+     * @param bool $addHeaders Whether to add rate limit headers to response
      */
-    public static function apply(string $type = 'default'): void {
-        // Periodically clean up old rate limit files (1% chance per request)
-        if (mt_rand(1, 100) === 1) {
+    public static function apply(string $type = 'default', bool $addHeaders = true): void {
+        // Periodically clean up old rate limit files (2% chance per request)
+        // Note: For production, use cron/cleanup_ratelimit.php for reliable cleanup
+        if (mt_rand(1, 50) === 1) {
             self::cleanupOldFiles();
         }
 
@@ -174,6 +217,9 @@ class RateLimitMiddleware {
             http_response_code(429);
             header('Content-Type: application/json');
             header('Retry-After: ' . self::WINDOW_SECONDS);
+            if ($addHeaders) {
+                self::addHeaders($type);
+            }
             echo json_encode([
                 'success' => false,
                 'error' => 'Rate limit exceeded. Please try again later.',
@@ -181,6 +227,11 @@ class RateLimitMiddleware {
             ]);
             exit;
         }
+
+        // Add rate limit headers to successful responses
+        if ($addHeaders) {
+            self::addHeaders($type);
+        }
     }
 
     /**