MCP: ticket links and similar-ticket search (#113)

- get_ticket now returns `links` (blocks / blocked_by / relates_to /
  duplicates / duplicated_by, phrased from this ticket's side, limited to
  linked tickets the user can see) and `blocked` (any open blocked_by).
- find_similar_tickets (tickets:read): the possible-duplicates finder, by
  title or by an existing ticket (which is excluded from the results).
- link_tickets / unlink_tickets (tickets:write). Marking a duplicate only
  records the link. unlink also finds a link stored from the other side
  ("B blocked_by A" for "A blocks B").

api/ticket_dependencies.php's list/add/remove logic moves to
services/DependencyService.php, used by both (same checks and messages).
DependencyModel's remove methods now return rows removed, so removing a
link that is already gone no longer writes a "deleted" audit row.

Also includes the port in ToolScopeMiddleware's resource_metadata URL
(matches the 401's; no effect on prod, which has no port).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MGDKHiU5RJdo3dqQUDow3X

README.md

@@ -128,11 +128,14 @@ claude mcp login tinker            # add --no-browser on a headless machine, the
 | Tool | Scope | What it does |
 |------|-------|--------------|
 | `search_tickets` | `tickets:read` | Search/list tickets you can see (text, status, priority, category, assignee `me`/`unassigned`/username), paginated |
-| `get_ticket` | `tickets:read` | One ticket's details + comments |
+| `get_ticket` | `tickets:read` | One ticket's details + comments, its links (Dependencies tab, phrased from this ticket's side incl. `duplicated_by`) and a `blocked` flag (any open `blocked_by`) |
+| `find_similar_tickets` | `tickets:read` | Open tickets with similar titles, by title text or an existing ticket (same finder as the ticket page's possible-duplicates list) |
 | `create_ticket` | `tickets:write` | Create a ticket (title, description, priority, category, type, visibility, assignee) |
 | `add_comment` | `tickets:write` | Comment (markdown, @mentions, replies) |
 | `update_status` | `tickets:write` | Workflow-validated status change; `comment` required when the transition requires one |
 | `assign_ticket` | `tickets:write` | Assign / unassign (admin, creator, or current assignee only) |
+| `link_tickets` | `tickets:write` | Add a `blocks` / `blocked_by` / `relates_to` / `duplicates` link ("A duplicates B" = A is the duplicate; links only, never closes anything) |
+| `unlink_tickets` | `tickets:write` | Remove a link, whichever ticket's side it was recorded from |
 
 How it fits together (see issue #111 for the full design):
 - **Authelia** is the authorization server: client `tinker-tickets-mcp`, custom scopes `tickets:read`/`tickets:write`, RS256 JWT access tokens carrying `preferred_username`/`groups`. Needs Authelia **≠ 4.39.21/4.39.22** (RFC 8707 `resource` bug); 4.39.20 or ≥ 4.39.23 are fine.
@@ -444,6 +447,8 @@ tinker_tickets/
 ├── services/
 │   ├── AssignmentService.php             # Assign/unassign (shared by assign_ticket.php + MCP)
 │   ├── CommentService.php                # Add comment + mentions/notifications (shared by add_comment.php + MCP)
+│   ├── DependencyService.php             # List/add/remove ticket links (shared by ticket_dependencies.php + MCP)
+│   ├── SimilarTicketService.php          # Similar-title finder (shared by check_duplicates.php + MCP)
 │   └── TicketCreationService.php         # Create ticket (shared by TicketController + MCP)
 ├── uploads/                              # File attachment storage (served only via PHP; nginx: internal)
 │   └── avatars/                          # lldap avatar disk cache