feat: Wahab demo prep — Cancelled status, phone persistence, admin delete, users picker, detail-page fixes

- Add Cancelled as terminal status reachable from all active states; exclude
  from SLA breach reporting and dashboard active counts; add to status pickers
- Persist customer phone on ticket create/update (was silently dropped);
  add tickets.phone migration + legacy self-heal guard
- Add admin-only DELETE /api/tickets/{id} (removes timeline/photos/escalations)
- Add GET /api/auth/users for the assign-technician dropdown (was hardcoded)
- TicketOut now returns nested unit/category so the detail page stops showing
  '—' for Unit/Property/Category
- Ticket numbering uses max+1 so deletions never re-issue a number
- New-issue form: require Category and (standard mode) Priority client-side
- Tests: 11 new cases covering cancellation, SLA exemption, phone, delete,
  users endpoint, numbering

app/templates/dashboard/fm.html

@@ -222,7 +222,7 @@
                     const all = data.items;
 
                     // Active: not closed/completed
-                    const active = all.filter(t => !['Closed', 'Completed'].includes(t.status));
+                    const active = all.filter(t => !['Closed', 'Completed', 'Cancelled'].includes(t.status));
                     this.activeTickets = active;
 
                     // KPIs