Fix helpers/config: timezone, comment leak, silent misconfig, cache perms

- Database.php: pin MySQL session time_zone to the configured named zone
  (mysql.time_zone tables now loaded on the DB) with a fixed-offset
  fallback, so NOW()/TIMESTAMP and PHP agree regardless of the DB server's
  SYSTEM tz. Best-effort, never fatals the connection.
- NotificationHelper: redact comment-body previews for internal/
  confidential tickets in sendCommentNotification and notifyWatchers so
  they are not leaked to the shared Matrix notify list (new $visibility
  param; callers wired in the API batch).
- config.php: die with a clear error if parse_ini_file fails instead of
  silently falling back to insecure defaults (empty DB pass / proxies).
- CacheHelper: create cache dir 0700 and cache files 0600 so other local
  users cannot read or poison security-relevant cached data.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

helpers/CacheHelper.php

@@ -21,7 +21,13 @@ class CacheHelper
         if (self::$cacheDir === null) {
             self::$cacheDir = sys_get_temp_dir() . '/tinker_tickets_cache';
             if (!is_dir(self::$cacheDir)) {
-                mkdir(self::$cacheDir, 0755, true);
+                // 0700: only the app user may read cached data or create files.
+                // mkdir mode is masked by umask, so chmod to enforce it.
+                mkdir(self::$cacheDir, 0700, true);
+                @chmod(self::$cacheDir, 0700);
+            } elseif (!function_exists('posix_geteuid') || fileowner(self::$cacheDir) === posix_geteuid()) {
+                // Existing dir we own: harden a previously world-readable dir.
+                @chmod(self::$cacheDir, 0700);
             }
         }
         return self::$cacheDir;
@@ -106,7 +112,13 @@ class CacheHelper
 
         // Store in file cache
         $filePath = self::getCacheDir() . '/' . $key . '.json';
-        return @file_put_contents($filePath, json_encode($cached), LOCK_EX) !== false;
+        $written = @file_put_contents($filePath, json_encode($cached), LOCK_EX) !== false;
+        if ($written) {
+            // 0600: cache may feed security-relevant reads; keep it non-readable
+            // to other local users and non-poisonable by pre-created files.
+            @chmod($filePath, 0600);
+        }
+        return $written;
     }
 
     /**