Fix data-layer bugs: bind_param fatals, ticket_id bindings, cache poisoning

- CustomFieldModel: assign ?? fallbacks to variables before bind_param
  (by-reference args cannot be ?? expressions; fatal on PHP 8.2, custom
  fields were uncreatable/uneditable)
- RecurringTicketModel::create: fix swapped bind type for schedule_type
  (enum bound as int coerced 'daily' to 0, breaking the cron)
- TicketModel/CommentModel: bind varchar ticket_id as string not int so
  the unique index is usable and leading-zero IDs match; ticket_watchers
  (int column) left as integer
- TicketModel::deleteTicket: delete from custom_field_values (real table)
  not the nonexistent ticket_custom_fields
- TicketModel search: honor literal '0'; never emit AGAINST('*') on
  all-special-char input (fall back to LIKE)
- TicketModel::updateTicket: disambiguate not-found vs no-op vs genuine
  optimistic-lock conflict on zero affected rows
- WorkflowModel: do not cache transitions/statuses on DB failure (a
  transient error no longer blocks all status changes for the TTL)
- DependencyModel: filter linked tickets by visibility (new optional user
  context params) to stop confidential metadata leaking via dependencies
- BulkOperationsModel: validate status/priority/assignee before mutating
- AuditLogModel: gate getClientIP forwarded headers on trusted proxies;
  add missing action/entity types so audit-log filters work
- WorkflowModel: add transitionRequiresComment() accessor for enforcement
- CommentModel: stop leaking raw DB errors to clients (log instead)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

models/AuditLogModel.php

@@ -19,13 +19,15 @@ class AuditLogModel
     /** @var array Allowed action types for filtering */
     private const VALID_ACTION_TYPES = [
         'create', 'update', 'delete', 'view', 'security_event',
-        'login', 'logout', 'assign', 'comment', 'bulk_update'
+        'login', 'logout', 'assign', 'unassign', 'comment', 'mention',
+        'revoke', 'attachment_upload', 'attachment_delete', 'bulk_update'
     ];
 
     /** @var array Allowed entity types for filtering */
     private const VALID_ENTITY_TYPES = [
         'ticket', 'comment', 'user', 'api_key', 'security',
-        'template', 'attachment', 'group'
+        'template', 'attachment', 'ticket_attachments', 'group',
+        'dependency', 'workflow_transition'
     ];
 
     public function __construct($conn)
@@ -327,24 +329,44 @@ class AuditLogModel
      */
     private function getClientIP()
     {
-        $ipAddress = '';
+        $remoteAddr = $_SERVER['REMOTE_ADDR'] ?? '';
 
-        // Check for proxy headers
-        if (!empty($_SERVER['HTTP_CF_CONNECTING_IP'])) {
-            // Cloudflare
-            $ipAddress = $_SERVER['HTTP_CF_CONNECTING_IP'];
-        } elseif (!empty($_SERVER['HTTP_X_REAL_IP'])) {
-            // Nginx proxy
-            $ipAddress = $_SERVER['HTTP_X_REAL_IP'];
-        } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
-            // Standard proxy header
-            $ipAddress = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'])[0];
-        } elseif (!empty($_SERVER['REMOTE_ADDR'])) {
-            // Direct connection
-            $ipAddress = $_SERVER['REMOTE_ADDR'];
+        // Forwarded/proxy headers are client-controlled, so only believe them when
+        // the request actually came from a trusted reverse proxy (same rule as
+        // RateLimitMiddleware). Otherwise a client could forge its audit-log IP.
+        $trusted = $GLOBALS['config']['TRUSTED_PROXIES'] ?? [];
+        if (empty($trusted) || !in_array($remoteAddr, $trusted, true)) {
+            return trim($remoteAddr);
         }
 
-        return trim($ipAddress);
+        // Cloudflare sets CF-Connecting-IP to the real client.
+        if (
+            !empty($_SERVER['HTTP_CF_CONNECTING_IP'])
+            && filter_var($_SERVER['HTTP_CF_CONNECTING_IP'], FILTER_VALIDATE_IP)
+        ) {
+            return trim($_SERVER['HTTP_CF_CONNECTING_IP']);
+        }
+
+        // The trusted proxy appends the connecting client to X-Forwarded-For, so
+        // the RIGHTMOST entry is the IP it observed (any client-supplied prefix is
+        // not trustworthy).
+        if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
+            $ips = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
+            $ip = trim(end($ips));
+            if (filter_var($ip, FILTER_VALIDATE_IP)) {
+                return $ip;
+            }
+        }
+
+        // X-Real-IP is set by the proxy itself.
+        if (
+            !empty($_SERVER['HTTP_X_REAL_IP'])
+            && filter_var($_SERVER['HTTP_X_REAL_IP'], FILTER_VALIDATE_IP)
+        ) {
+            return trim($_SERVER['HTTP_X_REAL_IP']);
+        }
+
+        return trim($remoteAddr);
     }
 
     /**