Fix API correctness: external API stub/collision, recurring dates, CSV, audit

- create_ticket_api.php: remove the wrong CREATE TABLE stub that broke a
  fresh DB; generate collision-safe ticket_ids so a genuine id collision
  isn't misreported as a duplicate and a hw alert dropped; stop leaking
  raw DB errors; correct a reopen comment that falsely claimed refreshed
  sensor data
- manage_recurring.php: fix next-run so create/edit no longer skips the
  current period (monthly day-of-month this month, daily today if time
  not passed, correct ISO weekday, month-length clamp); only recompute
  on schedule changes to avoid double-fire
- export_tickets.php, audit_log.php: neutralize CSV formula injection
- revoke_api_key.php, generate_api_key.php: correct HTTP status codes and
  stop the catch clobbering specific 4xx codes
- health.php: stop leaking PHP version / extension names / paths to
  unauthenticated callers
- watch_ticket.php: define $data before use
- manage_templates/recurring/custom_fields: add audit logging for CRUD;
  add recurring_ticket + custom_field to the audit entity whitelist

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

api/manage_templates.php

@@ -14,6 +14,7 @@ RateLimitMiddleware::apply('api');
 try {
     require_once dirname(__DIR__) . '/config/config.php';
     require_once dirname(__DIR__) . '/helpers/Database.php';
+    require_once dirname(__DIR__) . '/models/AuditLogModel.php';
 
     // Check authentication
     if (session_status() === PHP_SESSION_NONE) {
@@ -48,6 +49,8 @@ try {
 
     header('Content-Type: application/json');
 
+    $auditLog = new AuditLogModel($conn);
+    $currentUserId = $_SESSION['user']['user_id'];
     $method = $_SERVER['REQUEST_METHOD'];
     $id = isset($_GET['id']) ? (int)$_GET['id'] : null;
 
@@ -110,7 +113,13 @@ try {
             );
 
             if ($stmt->execute()) {
-                echo json_encode(['success' => true, 'template_id' => $conn->insert_id]);
+                $newTemplateId = $conn->insert_id;
+                $auditLog->log($currentUserId, 'create', 'template', (string)$newTemplateId, [
+                    'template_name' => $templateName,
+                    'category' => $category,
+                    'type' => $type
+                ]);
+                echo json_encode(['success' => true, 'template_id' => $newTemplateId]);
             } else {
                 error_log("Template creation failed: " . $stmt->error);
                 echo json_encode(['success' => false, 'error' => 'Failed to create template']);
@@ -161,7 +170,15 @@ try {
                 $id
             );
 
-            echo json_encode(['success' => $stmt->execute()]);
+            $updated = $stmt->execute();
+            if ($updated) {
+                $auditLog->log($currentUserId, 'update', 'template', (string)$id, [
+                    'template_name' => $templateName,
+                    'category' => $category,
+                    'type' => $type
+                ]);
+            }
+            echo json_encode(['success' => $updated]);
             $stmt->close();
             break;
 
@@ -171,9 +188,22 @@ try {
                 exit;
             }
 
+            // Capture the name before deletion for the audit record.
+            $nameStmt = $conn->prepare("SELECT template_name FROM ticket_templates WHERE template_id = ?");
+            $nameStmt->bind_param('i', $id);
+            $nameStmt->execute();
+            $delRow = $nameStmt->get_result()->fetch_assoc();
+            $nameStmt->close();
+
             $stmt = $conn->prepare("DELETE FROM ticket_templates WHERE template_id = ?");
             $stmt->bind_param('i', $id);
-            echo json_encode(['success' => $stmt->execute()]);
+            $deleted = $stmt->execute();
+            if ($deleted) {
+                $auditLog->log($currentUserId, 'delete', 'template', (string)$id, [
+                    'template_name' => $delRow['template_name'] ?? 'unknown'
+                ]);
+            }
+            echo json_encode(['success' => $deleted]);
             $stmt->close();
             break;