feat(api): maintenance tickets — schema, lifecycle & routes

[ankitsejwal]

First slice of the maintenance tickets vertical (M2). Backend only — web + mobile UIs follow in separate PRs.

What

• DB (migration 0001, additive): maintenance_tickets table + ticket_status / ticket_category / ticket_priority enums.
• Shared: Zod contracts + a ticket state machine mirroring the visitor one — OPEN→IN_PROGRESS→RESOLVED→CLOSED, plus reopen (RESOLVED→IN_PROGRESS) and cancel (OPEN/IN_PROGRESS→CANCELLED).
• API (/tickets):
  • POST / — residents raise a ticket for an apartment they live in (residency-checked); admins may raise for any.
  • GET /?status= — admins see all; residents see only their apartments' tickets.
  • POST /:id/transition (admin) — drives the lifecycle; resolve stamps resolvedAt + optional note; illegal transitions → 409.
  • PATCH /:id/assign (admin) — assigns to a user (validates the assignee exists → 404).

Verified E2E (curl, live Neon)

• Lifecycle: create→OPEN, start→IN_PROGRESS, resolve→RESOLVED (resolvedAt + note), close→CLOSED; illegal start-from-RESOLVED & reopen-from-CLOSED → 409.
• Assign sets assignedTo; bogus assignee → 404.
• Authz: resident-without-residency create → 403; resident transition → 403; unauthenticated → 401.
• Resident WITH residency: create for own apt → 201, other apt → 403; scoped GET returns only their apartment's tickets; ?status=CLOSED filter honored.
• 32 new state-machine unit tests (98 API tests total); full gate green.