feat: Wahab demo prep — Cancelled status, phone persistence, admin delete, users picker, detail-page fixes

- Add Cancelled as terminal status reachable from all active states; exclude
  from SLA breach reporting and dashboard active counts; add to status pickers
- Persist customer phone on ticket create/update (was silently dropped);
  add tickets.phone migration + legacy self-heal guard
- Add admin-only DELETE /api/tickets/{id} (removes timeline/photos/escalations)
- Add GET /api/auth/users for the assign-technician dropdown (was hardcoded)
- TicketOut now returns nested unit/category so the detail page stops showing
  '—' for Unit/Property/Category
- Ticket numbering uses max+1 so deletions never re-issue a number
- New-issue form: require Category and (standard mode) Priority client-side
- Tests: 11 new cases covering cancellation, SLA exemption, phone, delete,
  users endpoint, numbering

app/templates/tickets/new.html

@@ -363,6 +363,16 @@
                         this.submitting = false;
                         return;
                     }
+                    if (!this.form.category_main && !this.form.category_id) {
+                        this.error = 'Please select a Category — every issue needs one for correct routing and SLA.';
+                        this.submitting = false;
+                        return;
+                    }
+                    if (this.mode === 'standard' && !this.form.priority) {
+                        this.error = 'Please select a Priority — without one the ticket gets no SLA deadline.';
+                        this.submitting = false;
+                        return;
+                    }
 
                     // Create the ticket
                     const payload = {