Add schema baseline, fix cron/retention, restore cleanup, correct docs

- migrations/000_baseline.sql: full schema baseline captured from prod
  (validated on a throwaway DB: 17 tables/17 FKs), so the schema is
  reproducible for fresh installs / disaster recovery
- create_recurring_tickets cron: send the Matrix ticket-created
  notification and invalidate the stats cache like the other create paths
- create_ticket_api.php + TicketController::create: invalidate the stats
  cache on create/escalate/reopen so dashboard counts aren't stale
- scripts/cleanup_orphan_uploads.php: restored, made safe (24h mtime
  grace, 9-digit-dir only, skips avatars/symlinks, matches the unique
  filename column, --dry-run)
- cron/cleanup_audit_log.php: enforce the configured audit-log retention
  (deleteOldLogs was implemented but never called)
- README: correct CSRF-rotation, hwmon dedup (no 24h window), SLA (no P3),
  stats-cache callers, and the project structure/endpoint listing
- .env.example: document TRUSTED_PROXIES fail-open risk and .env quoting

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cron/create_recurring_tickets.php

@@ -17,9 +17,11 @@ chdir(dirname(__DIR__));
 // Include required files
 require_once 'config/config.php';
 require_once 'helpers/Database.php';
+require_once 'helpers/NotificationHelper.php';
 require_once 'models/RecurringTicketModel.php';
 require_once 'models/TicketModel.php';
 require_once 'models/AuditLogModel.php';
+require_once 'models/StatsModel.php';
 
 // Log function
 function logMessage($message)
@@ -92,6 +94,10 @@ try {
                     ['source' => 'recurring', 'recurring_id' => $recurring['recurring_id']]
                 );
 
+                // Fire the same Matrix "ticket created" notification the manual and
+                // external-API create paths send, so recurring tickets aren't silent.
+                NotificationHelper::sendTicketNotification($ticketId, $ticketData, 'automated');
+
                 $created++;
             } else {
                 logMessage("ERROR: Failed to create ticket - " . ($result['error'] ?? 'Unknown error'));
@@ -103,6 +109,12 @@ try {
         }
     }
 
+    // Ticket counts changed — invalidate the cached dashboard stats once for the
+    // whole run (mirrors the manual/API create paths, which invalidate per create).
+    if ($created > 0) {
+        (new StatsModel($conn))->invalidateCache();
+    }
+
     logMessage("Completed: Created $created tickets, $errors errors");
 
     Database::close();