Implement comprehensive improvement plan (Phases 1-6)

Security (Phase 1-2):
- Add SecurityHeadersMiddleware with CSP, X-Frame-Options, etc.
- Add RateLimitMiddleware for API rate limiting
- Add security event logging to AuditLogModel
- Add ResponseHelper for standardized API responses
- Update config.php with security constants

Database (Phase 3):
- Add migration 014 for additional indexes
- Add migration 015 for ticket dependencies
- Add migration 016 for ticket attachments
- Add migration 017 for recurring tickets
- Add migration 018 for custom fields

Features (Phase 4-5):
- Add ticket dependencies with DependencyModel and API
- Add duplicate detection with check_duplicates API
- Add file attachments with AttachmentModel and upload/download APIs
- Add @mentions with autocomplete and highlighting
- Add quick actions on dashboard rows

Collaboration (Phase 5):
- Add mention extraction in CommentModel
- Add mention autocomplete dropdown in ticket.js
- Add mention highlighting CSS styles

Admin & Export (Phase 6):
- Add StatsModel for dashboard widgets
- Add dashboard stats cards (open, critical, unassigned, etc.)
- Add CSV/JSON export via export_tickets API
- Add rich text editor toolbar in markdown.js
- Add RecurringTicketModel with cron job
- Add CustomFieldModel for per-category fields
- Add admin views: RecurringTickets, CustomFields, Workflow,
  Templates, AuditLog, UserActivity
- Add admin APIs: manage_workflows, manage_templates,
  manage_recurring, custom_fields, get_users
- Add admin routes in index.php

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

api/delete_attachment.php

@@ -0,0 +1,102 @@
+<?php
+/**
+ * Delete Attachment API
+ *
+ * Handles deletion of ticket attachments
+ */
+
+// Apply rate limiting
+require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
+RateLimitMiddleware::apply('api');
+
+session_start();
+require_once dirname(__DIR__) . '/config/config.php';
+require_once dirname(__DIR__) . '/helpers/ResponseHelper.php';
+require_once dirname(__DIR__) . '/models/AttachmentModel.php';
+require_once dirname(__DIR__) . '/models/AuditLogModel.php';
+require_once dirname(__DIR__) . '/middleware/CsrfMiddleware.php';
+
+header('Content-Type: application/json');
+
+// Check authentication
+if (!isset($_SESSION['user']) || !isset($_SESSION['user']['user_id'])) {
+    ResponseHelper::unauthorized();
+}
+
+// Only accept DELETE or POST requests
+if (!in_array($_SERVER['REQUEST_METHOD'], ['DELETE', 'POST'])) {
+    ResponseHelper::error('Method not allowed', 405);
+}
+
+// Get request body
+$input = json_decode(file_get_contents('php://input'), true);
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    $input = array_merge($_POST, $input ?? []);
+}
+
+// Verify CSRF token
+$csrfToken = $input['csrf_token'] ?? $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
+if (!CsrfMiddleware::validateToken($csrfToken)) {
+    $auditLog = new AuditLogModel();
+    $auditLog->logCsrfFailure($_SESSION['user']['user_id'] ?? null, 'delete_attachment');
+    ResponseHelper::forbidden('Invalid CSRF token');
+}
+
+// Get attachment ID
+$attachmentId = $input['attachment_id'] ?? null;
+if (!$attachmentId || !is_numeric($attachmentId)) {
+    ResponseHelper::error('Valid attachment ID is required');
+}
+
+$attachmentId = (int)$attachmentId;
+
+try {
+    $attachmentModel = new AttachmentModel();
+
+    // Get attachment details
+    $attachment = $attachmentModel->getAttachment($attachmentId);
+    if (!$attachment) {
+        ResponseHelper::notFound('Attachment not found');
+    }
+
+    // Check permission
+    $isAdmin = $_SESSION['user']['is_admin'] ?? false;
+    if (!$attachmentModel->canUserDelete($attachmentId, $_SESSION['user']['user_id'], $isAdmin)) {
+        ResponseHelper::forbidden('You do not have permission to delete this attachment');
+    }
+
+    // Delete the file
+    $uploadDir = $GLOBALS['config']['UPLOAD_DIR'] ?? dirname(__DIR__) . '/uploads';
+    $filePath = $uploadDir . '/' . $attachment['ticket_id'] . '/' . $attachment['filename'];
+
+    if (file_exists($filePath)) {
+        if (!unlink($filePath)) {
+            ResponseHelper::serverError('Failed to delete file');
+        }
+    }
+
+    // Delete from database
+    if (!$attachmentModel->deleteAttachment($attachmentId)) {
+        ResponseHelper::serverError('Failed to delete attachment record');
+    }
+
+    // Log the deletion
+    $auditLog = new AuditLogModel();
+    $auditLog->log(
+        $_SESSION['user']['user_id'],
+        'attachment_delete',
+        'ticket_attachments',
+        $attachmentId,
+        json_encode([
+            'ticket_id' => $attachment['ticket_id'],
+            'filename' => $attachment['original_filename'],
+            'size' => $attachment['file_size']
+        ]),
+        null
+    );
+
+    ResponseHelper::success([], 'Attachment deleted successfully');
+
+} catch (Exception $e) {
+    ResponseHelper::serverError('Failed to delete attachment');
+}