feat: Wahab demo prep — Cancelled status, phone persistence, admin delete, users picker, detail-page fixes

- Add Cancelled as terminal status reachable from all active states; exclude
  from SLA breach reporting and dashboard active counts; add to status pickers
- Persist customer phone on ticket create/update (was silently dropped);
  add tickets.phone migration + legacy self-heal guard
- Add admin-only DELETE /api/tickets/{id} (removes timeline/photos/escalations)
- Add GET /api/auth/users for the assign-technician dropdown (was hardcoded)
- TicketOut now returns nested unit/category so the detail page stops showing
  '—' for Unit/Property/Category
- Ticket numbering uses max+1 so deletions never re-issue a number
- New-issue form: require Category and (standard mode) Priority client-side
- Tests: 11 new cases covering cancellation, SLA exemption, phone, delete,
  users endpoint, numbering

app/templates/dashboard/cs.html

@@ -188,20 +188,20 @@
                     const newToday = all.filter(t => new Date(t.created_at) >= today && t.status === 'New').length;
 
                     // Open tickets (not closed/completed)
-                    const open = all.filter(t => !['Closed', 'Completed'].includes(t.status));
+                    const open = all.filter(t => !['Closed', 'Completed', 'Cancelled'].includes(t.status));
 
                     // By priority
                     const byPriority = { urgent: 0, high: 0, medium: 0, low: 0 };
                     open.forEach(t => { if (t.priority) byPriority[t.priority] = (byPriority[t.priority] || 0) + 1; });
 
                     // Oldest unassigned
-                    const unassigned = all.filter(t => !t.assigned_to && !['Closed', 'Completed'].includes(t.status))
+                    const unassigned = all.filter(t => !t.assigned_to && !['Closed', 'Completed', 'Cancelled'].includes(t.status))
                         .sort((a, b) => new Date(a.created_at) - new Date(b.created_at));
                     this.oldestUnassigned = unassigned[0] || null;
 
                     // SLA compliance (rough: tickets with sla_deadline not breached)
                     const withSLA = all.filter(t => t.sla_deadline);
-                    const slaMet = withSLA.filter(t => new Date(t.sla_deadline) > new Date() || ['Closed', 'Completed'].includes(t.status));
+                    const slaMet = withSLA.filter(t => new Date(t.sla_deadline) > new Date() || ['Closed', 'Completed', 'Cancelled'].includes(t.status));
 
                     this.kpi = {
                         newToday,
@@ -230,7 +230,7 @@
 
             calcAvgResponse(all) {
                 // Rough approximation — in real system this would come from timeline analysis
-                const open = all.filter(t => !['Closed', 'Completed'].includes(t.status));
+                const open = all.filter(t => !['Closed', 'Completed', 'Cancelled'].includes(t.status));
                 if (!open.length) return '—';
                 const avgHrs = open.reduce((sum, t) => {
                     const diff = (new Date() - new Date(t.created_at)) / (1000 * 60 * 60);