Fix data-layer bugs: bind_param fatals, ticket_id bindings, cache poisoning

- CustomFieldModel: assign ?? fallbacks to variables before bind_param
  (by-reference args cannot be ?? expressions; fatal on PHP 8.2, custom
  fields were uncreatable/uneditable)
- RecurringTicketModel::create: fix swapped bind type for schedule_type
  (enum bound as int coerced 'daily' to 0, breaking the cron)
- TicketModel/CommentModel: bind varchar ticket_id as string not int so
  the unique index is usable and leading-zero IDs match; ticket_watchers
  (int column) left as integer
- TicketModel::deleteTicket: delete from custom_field_values (real table)
  not the nonexistent ticket_custom_fields
- TicketModel search: honor literal '0'; never emit AGAINST('*') on
  all-special-char input (fall back to LIKE)
- TicketModel::updateTicket: disambiguate not-found vs no-op vs genuine
  optimistic-lock conflict on zero affected rows
- WorkflowModel: do not cache transitions/statuses on DB failure (a
  transient error no longer blocks all status changes for the TTL)
- DependencyModel: filter linked tickets by visibility (new optional user
  context params) to stop confidential metadata leaking via dependencies
- BulkOperationsModel: validate status/priority/assignee before mutating
- AuditLogModel: gate getClientIP forwarded headers on trusted proxies;
  add missing action/entity types so audit-log filters work
- WorkflowModel: add transitionRequiresComment() accessor for enforcement
- CommentModel: stop leaking raw DB errors to clients (log instead)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

models/CustomFieldModel.php

@@ -96,6 +96,10 @@ class CustomFieldModel
                 (field_name, field_label, field_type, field_options, category, is_required, display_order, is_active)
                 VALUES (?, ?, ?, ?, ?, ?, ?, ?)";
 
+        $isRequired = $data['is_required'] ?? 0;
+        $displayOrder = $data['display_order'] ?? 0;
+        $isActive = $data['is_active'] ?? 1;
+
         $stmt = $this->conn->prepare($sql);
         $stmt->bind_param(
             'sssssiii',
@@ -104,9 +108,9 @@ class CustomFieldModel
             $data['field_type'],
             $options,
             $data['category'],
-            $data['is_required'] ?? 0,
-            $data['display_order'] ?? 0,
-            $data['is_active'] ?? 1
+            $isRequired,
+            $displayOrder,
+            $isActive
         );
 
         if ($stmt->execute()) {
@@ -135,6 +139,10 @@ class CustomFieldModel
                 category = ?, is_required = ?, display_order = ?, is_active = ?
                 WHERE field_id = ?";
 
+        $isRequired = $data['is_required'] ?? 0;
+        $displayOrder = $data['display_order'] ?? 0;
+        $isActive = $data['is_active'] ?? 1;
+
         $stmt = $this->conn->prepare($sql);
         $stmt->bind_param(
             'sssssiiii',
@@ -143,9 +151,9 @@ class CustomFieldModel
             $data['field_type'],
             $options,
             $data['category'],
-            $data['is_required'] ?? 0,
-            $data['display_order'] ?? 0,
-            $data['is_active'] ?? 1,
+            $isRequired,
+            $displayOrder,
+            $isActive,
             $fieldId
         );