Add schema baseline, fix cron/retention, restore cleanup, correct docs

- migrations/000_baseline.sql: full schema baseline captured from prod
  (validated on a throwaway DB: 17 tables/17 FKs), so the schema is
  reproducible for fresh installs / disaster recovery
- create_recurring_tickets cron: send the Matrix ticket-created
  notification and invalidate the stats cache like the other create paths
- create_ticket_api.php + TicketController::create: invalidate the stats
  cache on create/escalate/reopen so dashboard counts aren't stale
- scripts/cleanup_orphan_uploads.php: restored, made safe (24h mtime
  grace, 9-digit-dir only, skips avatars/symlinks, matches the unique
  filename column, --dry-run)
- cron/cleanup_audit_log.php: enforce the configured audit-log retention
  (deleteOldLogs was implemented but never called)
- README: correct CSRF-rotation, hwmon dedup (no 24h window), SLA (no P3),
  stats-cache callers, and the project structure/endpoint listing
- .env.example: document TRUSTED_PROXIES fail-open risk and .env quoting

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -1,5 +1,11 @@
 # Tinker Tickets Environment Configuration
 # Copy this file to .env and fill in your values
+#
+# NOTE: This file is parsed with parse_ini_file(). Any value containing special
+# characters (#, ;, =, quotes, spaces, etc.) MUST be wrapped in double quotes,
+# e.g. DB_PASS="p@ss;word#1". The application now fails loudly (dies with a clear
+# error) if the .env file cannot be parsed, so an unquoted special character will
+# take the whole app down rather than silently using a wrong value.
 
 # Database Configuration
 DB_HOST=10.10.10.50
@@ -25,11 +31,18 @@ APP_DOMAIN=
 ALLOWED_HOSTS=localhost,127.0.0.1
 
 # Trusted reverse proxy IP(s), comma-separated (e.g. the Authelia/nginx proxy).
-# STRONGLY RECOMMENDED in production: Authelia forward-auth (Remote-User /
-# Remote-Groups) and forwarded client IPs are only trusted when REMOTE_ADDR is
-# in this list. Leaving it empty disables that protection (relies solely on
-# network topology) and lets anything reaching PHP directly spoof admin login.
-# Exact IP match only (no CIDR). Example: TRUSTED_PROXIES=10.10.10.27
+# Set this to the IP address(es) of your reverse proxy. Authelia forward-auth
+# headers (Remote-User / Remote-Groups) and forwarded client IPs are only
+# trusted when REMOTE_ADDR is in this list.
+#
+# Leaving this EMPTY disables reverse-proxy verification entirely: the app then
+# trusts Remote-User / Remote-Groups headers from ANY source. That is unsafe if
+# the PHP backend is reachable directly (bypassing the proxy), because a client
+# can then spoof those headers and log in as an admin. Only leave it empty when
+# network topology guarantees PHP is reachable solely via the trusted proxy.
+#
+# Exact IP match only (no CIDR). Example (single proxy): TRUSTED_PROXIES=10.10.10.27
+# Example (multiple):                                     TRUSTED_PROXIES=10.10.10.27,10.10.10.28
 TRUSTED_PROXIES=
 
 # Timezone (default: America/New_York)