feat: Wahab demo prep — Cancelled status, phone persistence, admin delete, users picker, detail-page fixes

- Add Cancelled as terminal status reachable from all active states; exclude
  from SLA breach reporting and dashboard active counts; add to status pickers
- Persist customer phone on ticket create/update (was silently dropped);
  add tickets.phone migration + legacy self-heal guard
- Add admin-only DELETE /api/tickets/{id} (removes timeline/photos/escalations)
- Add GET /api/auth/users for the assign-technician dropdown (was hardcoded)
- TicketOut now returns nested unit/category so the detail page stops showing
  '—' for Unit/Property/Category
- Ticket numbering uses max+1 so deletions never re-issue a number
- New-issue form: require Category and (standard mode) Priority client-side
- Tests: 11 new cases covering cancellation, SLA exemption, phone, delete,
  users endpoint, numbering

app/models/ticket.py

@@ -29,7 +29,7 @@ class Ticket(Base):
         comment=(
             "New, Logged, Triage, Assigned, Accepted, Travelling, On Site, "
             "In Progress, Waiting Parts, Escalated, Completed, "
-            "On-Field Verification, Wahab Review, Closed, Reopened"
+            "On-Field Verification, Wahab Review, Closed, Reopened, Cancelled"
         ),
     )
     unit_id: Mapped[int | None] = mapped_column(Integer, ForeignKey("units.id"), nullable=True)
@@ -40,6 +40,7 @@ class Ticket(Base):
         comment="urgent, high, medium, low",
     )
     reporter: Mapped[str | None] = mapped_column(String(255), nullable=True)
+    phone: Mapped[str | None] = mapped_column(String(50), nullable=True)
     reported_via: Mapped[str | None] = mapped_column(
         String(20),
         nullable=True,