feat: Wahab demo prep — Cancelled status, phone persistence, admin delete, users picker, detail-page fixes

- Add Cancelled as terminal status reachable from all active states; exclude
  from SLA breach reporting and dashboard active counts; add to status pickers
- Persist customer phone on ticket create/update (was silently dropped);
  add tickets.phone migration + legacy self-heal guard
- Add admin-only DELETE /api/tickets/{id} (removes timeline/photos/escalations)
- Add GET /api/auth/users for the assign-technician dropdown (was hardcoded)
- TicketOut now returns nested unit/category so the detail page stops showing
  '—' for Unit/Property/Category
- Ticket numbering uses max+1 so deletions never re-issue a number
- New-issue form: require Category and (standard mode) Priority client-side
- Tests: 11 new cases covering cancellation, SLA exemption, phone, delete,
  users endpoint, numbering

app/services/sla.py

@@ -55,9 +55,12 @@ def should_escalate_on_response(ticket: Ticket) -> bool:
     return datetime.now(timezone.utc) > deadline
 
 
+TERMINAL_STATUSES = {"Closed", "Completed", "Cancelled"}
+
+
 def is_sla_breached(ticket: Ticket) -> bool:
     """Return True if the ticket's resolution SLA deadline has passed."""
-    if ticket.sla_deadline is None or ticket.status in ("Closed", "Completed"):
+    if ticket.sla_deadline is None or ticket.status in TERMINAL_STATUSES:
         return False
     deadline = ticket.sla_deadline
     if deadline.tzinfo is None:
@@ -88,7 +91,7 @@ async def get_sla_status(ticket: Ticket) -> dict:
         rd = resolution_deadline
         if rd.tzinfo is None:
             rd = rd.replace(tzinfo=timezone.utc)
-        resolution_breached = now > rd if ticket.status not in ("Closed", "Completed") else False
+        resolution_breached = now > rd if ticket.status not in TERMINAL_STATUSES else False
 
     return {
         "priority": ticket.priority,

app/services/ticket.py

@@ -6,11 +6,11 @@ from datetime import datetime, timezone
 from typing import Any
 
 from fastapi import HTTPException, status
-from sqlalchemy import func, select
+from sqlalchemy import delete as sa_delete, func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import selectinload
 
-from app.models.ticket import Escalation, Ticket, TicketTimeline
+from app.models.ticket import Escalation, Ticket, TicketPhoto, TicketTimeline
 from app.models.unit import Unit
 from app.models.user import User
 from app.services.sla import compute_sla_deadline
@@ -19,20 +19,22 @@ from app.services.sla import compute_sla_deadline
 # Keys: current status → list of valid next statuses
 VALID_TRANSITIONS: dict[str, list[str]] = {
     "New": ["Logged"],
-    "Logged": ["Triage", "Closed"],
-    "Triage": ["Assigned", "Escalated"],
-    "Assigned": ["Accepted", "Triage"],
-    "Accepted": ["Travelling", "Triage"],
-    "Travelling": ["On Site", "Triage"],
-    "On Site": ["In Progress", "Triage"],
-    "In Progress": ["Waiting Parts", "Escalated", "Completed"],
-    "Waiting Parts": ["In Progress", "Escalated"],
-    "Escalated": ["Triage", "In Progress", "Completed", "Closed"],
+    "Logged": ["Triage", "Closed", "Cancelled"],
+    "Triage": ["Assigned", "Escalated", "Cancelled"],
+    "Assigned": ["Accepted", "Triage", "Cancelled"],
+    "Accepted": ["Travelling", "Triage", "Cancelled"],
+    "Travelling": ["On Site", "Triage", "Cancelled"],
+    "On Site": ["In Progress", "Triage", "Cancelled"],
+    "In Progress": ["Waiting Parts", "Escalated", "Completed", "Cancelled"],
+    "Waiting Parts": ["In Progress", "Escalated", "Cancelled"],
+    "Escalated": ["Triage", "In Progress", "Completed", "Closed", "Cancelled"],
     "Completed": ["On-Field Verification", "In Progress"],
     "On-Field Verification": ["Wahab Review", "Completed", "Closed"],
     "Wahab Review": ["Closed", "On-Field Verification"],
     "Closed": ["Reopened"],
     "Reopened": ["Triage", "Logged"],
+    # Terminal: cancelled tickets cannot resume work.
+    "Cancelled": [],
 }
 
 REOPEN_WINDOW_DAYS = 7
@@ -41,15 +43,25 @@ SLA_ACK_USER = "Ama"
 
 # ── Helpers ──────────────────────────────────────────────────────────
 async def _generate_ticket_number(db: AsyncSession) -> str:
-    """Generate the next ticket number in PAV-YYYY-NNNNN format."""
+    """Generate the next ticket number in PAV-YYYY-NNNNN format.
+
+    Uses the highest existing suffix + 1 (not a row count) so that deleting
+    tickets never re-issues an already-used number.
+    """
     year = datetime.now(timezone.utc).year
     prefix = f"PAV-{year}-"
-    # Count existing tickets this year
     result = await db.execute(
-        select(func.count(Ticket.id)).where(Ticket.ticket_number.like(f"{prefix}%"))
+        select(func.max(Ticket.ticket_number)).where(Ticket.ticket_number.like(f"{prefix}%"))
     )
-    count = result.scalar() or 0
-    return f"{prefix}{count + 1:05d}"
+    max_number = result.scalar()
+    if max_number:
+        try:
+            next_seq = int(max_number.rsplit("-", 1)[1]) + 1
+        except (ValueError, IndexError):
+            next_seq = 1
+    else:
+        next_seq = 1
+    return f"{prefix}{next_seq:05d}"
 
 
 async def _log_status_change(
@@ -110,6 +122,7 @@ async def create_ticket(
         category_id=data.get("category_id"),
         priority=priority,
         reporter=data.get("reporter") or data.get("customer_name"),
+        phone=data.get("phone"),
         reported_via=data.get("reported_via"),
         description=data.get("description"),
         assigned_to=data.get("assigned_to"),
@@ -296,7 +309,7 @@ async def update_ticket(
         )
 
     # Update other fields
-    for field in ("unit_id", "category_id", "priority", "reporter", "reported_via",
+    for field in ("unit_id", "category_id", "priority", "reporter", "phone", "reported_via",
                   "description", "assigned_to", "eta", "cost", "parts_used"):
         if field in data:
             setattr(ticket, field, data[field])
@@ -310,3 +323,19 @@ async def update_ticket(
     return ticket
 
 
+async def delete_ticket(db: AsyncSession, ticket_id: int) -> Ticket:
+    """Delete a ticket and all dependent rows (timeline, photos, escalations).
+
+    Returns the deleted ticket so the caller can remove orphaned photo files.
+    """
+    ticket = await _get_ticket_or_404(db, ticket_id)
+
+    # Delete escalations, timeline, and photo rows first (FK children).
+    await db.execute(sa_delete(Escalation).where(Escalation.ticket_id == ticket_id))
+    await db.execute(sa_delete(TicketTimeline).where(TicketTimeline.ticket_id == ticket_id))
+    await db.execute(sa_delete(TicketPhoto).where(TicketPhoto.ticket_id == ticket_id))
+    await db.delete(ticket)
+    await db.flush()
+    return ticket
+
+