Implement comprehensive improvement plan (Phases 1-6)

Security (Phase 1-2):
- Add SecurityHeadersMiddleware with CSP, X-Frame-Options, etc.
- Add RateLimitMiddleware for API rate limiting
- Add security event logging to AuditLogModel
- Add ResponseHelper for standardized API responses
- Update config.php with security constants

Database (Phase 3):
- Add migration 014 for additional indexes
- Add migration 015 for ticket dependencies
- Add migration 016 for ticket attachments
- Add migration 017 for recurring tickets
- Add migration 018 for custom fields

Features (Phase 4-5):
- Add ticket dependencies with DependencyModel and API
- Add duplicate detection with check_duplicates API
- Add file attachments with AttachmentModel and upload/download APIs
- Add @mentions with autocomplete and highlighting
- Add quick actions on dashboard rows

Collaboration (Phase 5):
- Add mention extraction in CommentModel
- Add mention autocomplete dropdown in ticket.js
- Add mention highlighting CSS styles

Admin & Export (Phase 6):
- Add StatsModel for dashboard widgets
- Add dashboard stats cards (open, critical, unassigned, etc.)
- Add CSV/JSON export via export_tickets API
- Add rich text editor toolbar in markdown.js
- Add RecurringTicketModel with cron job
- Add CustomFieldModel for per-category fields
- Add admin views: RecurringTickets, CustomFields, Workflow,
  Templates, AuditLog, UserActivity
- Add admin APIs: manage_workflows, manage_templates,
  manage_recurring, custom_fields, get_users
- Add admin routes in index.php

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

models/AuditLogModel.php

@@ -290,6 +290,110 @@ class AuditLogModel {
         return $this->log($userId, 'view', 'ticket', $ticketId);
     }
 
+    // ========================================
+    // Security Event Logging Methods
+    // ========================================
+
+    /**
+     * Log a security event
+     *
+     * @param string $eventType Type of security event
+     * @param array $details Additional details
+     * @param int|null $userId User ID if known
+     * @return bool Success status
+     */
+    public function logSecurityEvent($eventType, $details = [], $userId = null) {
+        $details['event_type'] = $eventType;
+        $details['user_agent'] = $_SERVER['HTTP_USER_AGENT'] ?? 'Unknown';
+        return $this->log($userId, 'security_event', 'security', null, $details);
+    }
+
+    /**
+     * Log a failed authentication attempt
+     *
+     * @param string $username Username attempted
+     * @param string $reason Reason for failure
+     * @return bool Success status
+     */
+    public function logFailedAuth($username, $reason = 'Invalid credentials') {
+        return $this->logSecurityEvent('failed_auth', [
+            'username' => $username,
+            'reason' => $reason
+        ]);
+    }
+
+    /**
+     * Log a CSRF token failure
+     *
+     * @param string $endpoint The endpoint that was accessed
+     * @param int|null $userId User ID if session exists
+     * @return bool Success status
+     */
+    public function logCsrfFailure($endpoint, $userId = null) {
+        return $this->logSecurityEvent('csrf_failure', [
+            'endpoint' => $endpoint,
+            'method' => $_SERVER['REQUEST_METHOD'] ?? 'Unknown'
+        ], $userId);
+    }
+
+    /**
+     * Log a rate limit exceeded event
+     *
+     * @param string $endpoint The endpoint that was rate limited
+     * @param int|null $userId User ID if session exists
+     * @return bool Success status
+     */
+    public function logRateLimitExceeded($endpoint, $userId = null) {
+        return $this->logSecurityEvent('rate_limit_exceeded', [
+            'endpoint' => $endpoint
+        ], $userId);
+    }
+
+    /**
+     * Log an unauthorized access attempt
+     *
+     * @param string $resource The resource that was accessed
+     * @param int|null $userId User ID if session exists
+     * @return bool Success status
+     */
+    public function logUnauthorizedAccess($resource, $userId = null) {
+        return $this->logSecurityEvent('unauthorized_access', [
+            'resource' => $resource
+        ], $userId);
+    }
+
+    /**
+     * Get security events (for admin review)
+     *
+     * @param int $limit Maximum number of events
+     * @param int $offset Offset for pagination
+     * @return array Security events
+     */
+    public function getSecurityEvents($limit = 100, $offset = 0) {
+        $stmt = $this->conn->prepare(
+            "SELECT al.*, u.username, u.display_name
+             FROM audit_log al
+             LEFT JOIN users u ON al.user_id = u.user_id
+             WHERE al.action_type = 'security_event'
+             ORDER BY al.created_at DESC
+             LIMIT ? OFFSET ?"
+        );
+        $stmt->bind_param("ii", $limit, $offset);
+        $stmt->execute();
+        $result = $stmt->get_result();
+
+        $events = [];
+        while ($row = $result->fetch_assoc()) {
+            if ($row['details']) {
+                $row['details'] = json_decode($row['details'], true);
+            }
+            $events[] = $row;
+        }
+
+        $stmt->close();
+        return $events;
+    }
+
     /**
      * Get formatted timeline for a specific ticket
      * Includes all ticket updates and comments