Fix API correctness: external API stub/collision, recurring dates, CSV, audit

- create_ticket_api.php: remove the wrong CREATE TABLE stub that broke a
  fresh DB; generate collision-safe ticket_ids so a genuine id collision
  isn't misreported as a duplicate and a hw alert dropped; stop leaking
  raw DB errors; correct a reopen comment that falsely claimed refreshed
  sensor data
- manage_recurring.php: fix next-run so create/edit no longer skips the
  current period (monthly day-of-month this month, daily today if time
  not passed, correct ISO weekday, month-length clamp); only recompute
  on schedule changes to avoid double-fire
- export_tickets.php, audit_log.php: neutralize CSV formula injection
- revoke_api_key.php, generate_api_key.php: correct HTTP status codes and
  stop the catch clobbering specific 4xx codes
- health.php: stop leaking PHP version / extension names / paths to
  unauthenticated callers
- watch_ticket.php: define $data before use
- manage_templates/recurring/custom_fields: add audit logging for CRUD;
  add recurring_ticket + custom_field to the audit entity whitelist

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

api/health.php

@@ -135,11 +135,19 @@ $responseTime = round((microtime(true) - $startTime) * 1000, 2);
 // Set status code
 http_response_code($healthy ? 200 : 503);
 
+// This endpoint is unauthenticated, so expose only a coarse per-component status
+// and never the diagnostic messages (they leak PHP_VERSION, exact missing
+// extension names, and filesystem paths to anonymous callers).
+$publicChecks = [];
+foreach ($checks as $name => $check) {
+    $publicChecks[$name] = ['status' => $check['status']];
+}
+
 // Return response
 echo json_encode([
     'status' => $healthy ? 'healthy' : 'unhealthy',
     'timestamp' => date('c'),
     'response_time_ms' => $responseTime,
-    'checks' => $checks,
+    'checks' => $publicChecks,
     'version' => '1.0.0'
 ], JSON_PRETTY_PRINT);