Add schema baseline, fix cron/retention, restore cleanup, correct docs

- migrations/000_baseline.sql: full schema baseline captured from prod
  (validated on a throwaway DB: 17 tables/17 FKs), so the schema is
  reproducible for fresh installs / disaster recovery
- create_recurring_tickets cron: send the Matrix ticket-created
  notification and invalidate the stats cache like the other create paths
- create_ticket_api.php + TicketController::create: invalidate the stats
  cache on create/escalate/reopen so dashboard counts aren't stale
- scripts/cleanup_orphan_uploads.php: restored, made safe (24h mtime
  grace, 9-digit-dir only, skips avatars/symlinks, matches the unique
  filename column, --dry-run)
- cron/cleanup_audit_log.php: enforce the configured audit-log retention
  (deleteOldLogs was implemented but never called)
- README: correct CSRF-rotation, hwmon dedup (no 24h window), SLA (no P3),
  stats-cache callers, and the project structure/endpoint listing
- .env.example: document TRUSTED_PROXIES fail-open risk and .env quoting

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

create_ticket_api.php

@@ -60,6 +60,7 @@ require_once __DIR__ . '/config/config.php';
 // Authenticate via API key
 require_once __DIR__ . '/middleware/ApiKeyAuth.php';
 require_once __DIR__ . '/models/AuditLogModel.php';
+require_once __DIR__ . '/models/StatsModel.php';
 require_once __DIR__ . '/helpers/UrlHelper.php';
 
 $apiKeyAuth = new ApiKeyAuth($conn);
@@ -337,6 +338,9 @@ if ($existing) {
                     'status'   => $existingStatus,
                 ], 'automated');
             }
+
+            // Ticket state (priority/title/description) changed — refresh dashboard stats.
+            (new StatsModel($conn))->invalidateCache();
         }
 
         $conn->close();
@@ -373,6 +377,9 @@ if ($existing) {
         'reason' => 'auto-reopened by hwmonDaemon (issue recurred)',
     ]);
 
+    // Ticket reopened (Closed → Open) — refresh dashboard stats.
+    (new StatsModel($conn))->invalidateCache();
+
     $conn->close();
 
     require_once __DIR__ . '/helpers/NotificationHelper.php';
@@ -468,6 +475,9 @@ if ($inserted) {
         'type'     => $type,
     ]);
 
+    // New ticket created — refresh dashboard stats.
+    (new StatsModel($conn))->invalidateCache();
+
     $conn->close();
 
     require_once __DIR__ . '/helpers/NotificationHelper.php';