Harden recurring cron, bulk delete, error handling; fix semgrep CI

Continued fixes from the multi-agent review:

- recurring tickets cron: now that the parse error is fixed the job runs,
  exposing two latent bugs. (1) next_run_at was only advanced after the
  full success path, so any failure (e.g. a NULL created_by passed to the
  non-nullable assignTicket() $assignedBy -> TypeError) left it in the past
  and re-created a duplicate ticket every cron cycle. Added an atomic
  claimForRun() (conditional UPDATE gated on still-due) called BEFORE
  creation, which also prevents overlapping runs from double-creating.
  (2) The cron used a raw mysqli with no utf8mb4, corrupting non-ASCII
  content; it now uses Database::getConnection(). Also guard the assignment
  so created_by NULL falls back to the assignee.
- bulk delete: attachment files were unlinked inside the DB transaction, so
  an atomic-mode rollback restored rows but the files were already gone.
  deleteTicket() can now defer file removal to the caller, and
  BulkOperationsModel deletes files only after a successful commit.
- UserModel: back-tick the `groups` column (reserved word on MySQL 8.0.2+).
- create_ticket_api.php: stop leaking raw DB/exception messages to callers;
  log server-side and return a generic error. (Also includes a pre-existing
  working-tree tweak that adds title to the manual-ticket dedupe hash.)
- CI: semgrep install failed under PEP 668; add --break-system-packages.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

models/RecurringTicketModel.php

@@ -151,6 +151,44 @@ class RecurringTicketModel
         return $items;
     }
 
+    /**
+     * Atomically claim a due schedule for processing.
+     *
+     * Advances next_run_at (and stamps last_run_at) in a single conditional
+     * UPDATE gated on the row still being active and due. Returns true only if
+     * THIS call won the claim. This must be done BEFORE creating the ticket so
+     * that:
+     *   - two overlapping cron runs can't both process the same schedule, and
+     *   - a failure in a later step (ticket create, assignment, audit) can't
+     *     leave next_run_at in the past, which would re-fire — and re-create a
+     *     duplicate ticket — on every subsequent cron run.
+     *
+     * @return bool true if the schedule was claimed by this call
+     */
+    public function claimForRun($recurringId)
+    {
+        $recurring = $this->getById($recurringId);
+        if (!$recurring) {
+            return false;
+        }
+
+        $nextRun = $this->calculateNextRunTime(
+            $recurring['schedule_type'],
+            $recurring['schedule_day'],
+            $recurring['schedule_time']
+        );
+
+        $sql = "UPDATE recurring_tickets
+                   SET last_run_at = NOW(), next_run_at = ?
+                 WHERE recurring_id = ? AND is_active = 1 AND next_run_at <= NOW()";
+        $stmt = $this->conn->prepare($sql);
+        $stmt->bind_param('si', $nextRun, $recurringId);
+        $stmt->execute();
+        $claimed = $stmt->affected_rows > 0;
+        $stmt->close();
+        return $claimed;
+    }
+
     /**
      * Update last run and calculate next run time
      */