Quick-win fixes from second review

- create_ticket_api.php: validate status (against TICKET_STATUSES) and
  priority (numeric 1-5). A non-numeric priority previously cast to 0 and
  escalated the ticket below P1 on the dedup/update path.
- manage_workflows.php: reject empty/invalid from_status/to_status on POST
  and PUT (must be valid ticket statuses) so the workflow table can't be
  populated with bogus transitions.
- TicketModel::getAllTickets: COUNT(*) OVER() rides on returned rows, so a
  page past the last row returned total/pages = 0. Fall back to a direct
  COUNT when an over-range page yields no rows, keeping pager math correct.
- DashboardView: stop double-escaping category/type/assigned active-filter
  labels (they were htmlspecialchars'd into the label and again at output,
  rendering R&D as R&D); output escaping is retained.
- check_duplicates.php / NotificationHelper::notifyWatchers: wrap the DB
  lookups in try/catch so a failed prepare/query degrades gracefully
  (advisory dup-check returns none; best-effort watcher notify is skipped)
  instead of fataling the request. Works whether mysqli throws or returns
  false. (manage_* endpoints already have a top-level try/catch.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

create_ticket_api.php

@@ -231,6 +231,22 @@ $priority    = $data['priority'] ?? '4';
 $category    = (string)($data['category']    ?? 'General');
 $type        = (string)($data['type']        ?? 'Issue');
 
+// Validate externally-supplied status and priority. (category/type are free-form
+// in this schema.) A non-numeric priority would otherwise cast to 0 and escalate
+// the ticket below P1 on the dedup/update path.
+$validStatuses = $GLOBALS['config']['TICKET_STATUSES'] ?? ['Open', 'Pending', 'In Progress', 'Closed'];
+if (!in_array($status, $validStatuses, true)) {
+    http_response_code(400);
+    echo json_encode(['success' => false, 'error' => 'Invalid status']);
+    exit;
+}
+if (!is_numeric($priority) || (int)$priority < 1 || (int)$priority > 5) {
+    http_response_code(400);
+    echo json_encode(['success' => false, 'error' => 'Invalid priority (must be 1-5)']);
+    exit;
+}
+$priority = (int)$priority;
+
 $ticketHash = generateTicketHash($data);
 $auditLog   = new AuditLogModel($conn);