feat(db,ids): schema, TypeIDs and migrations for ticketing, RBAC & SLA

[melihsunbul]

What

Foundational data model for the ticketing/CRM, RBAC, SLA and content-visibility work that follows. This PR is schema + ID system + migrations + repository tooling only — it has no behaviour on its own; later PRs in the stack build features on top of it.

Concepts

• Branded TypeIDs (@quackback/ids) — every new entity gets a prefixed, type-safe identifier (for example tkt_…, role_…, team_…, org_…, inbox_…, sla_…), consistent with the project's existing ID convention.
• Additive schema — new tables and nullable/defaulted columns only; no existing table is reshaped and no data is rewritten destructively.
• Linear migration chain — the ticketing/authz tables are consolidated into a single migration, followed by small incremental migrations so the history stays readable.

How it works

• @quackback/ids — new prefixes and branded types plus Zod helpers for: tickets, ticket statuses/subscriptions/external-links, roles, role assignments, principals, teams, organisations, contacts, inboxes, routing rules, SLA policies, audit events, webhook deliveries, widget profiles, integration user-mappings/sync-log, and segment-override entities.
• @quackback/db schema — new tables: tickets, ticket-statuses, ticket-subscriptions, ticket-external-links, ticket-thread-external-links, roles, teams, organizations, inboxes, routing-rules, sla, audit-events, webhook-deliveries, integration-user-mappings, integration-sync-log, widget-profiles; additive columns on changelog, segments, kb, notifications, integrations, api-keys, auth. Barrel index.ts and shared types.ts updated.
• Migrations — 0113_ticketing_and_authz.sql (consolidated) then 0114–0125 (thread external links, widget profiles, channelId backfill, changelog taxonomy, ticket email preferences, GitHub sync mapping repair, requester-owned widget scope, portal-tab config, help-centre category audience, changelog visibility, visibility-metadata normalisation, external-surface permissions). Drizzle meta/ snapshots and _journal.json regenerated.
• Tooling — root vitest.config.ts, bun.lock/package.json dependency updates, docker-compose.yml, deploy/self-hosted, CONTRIBUTING.md/CLAUDE.md notes, and the i18n locales/*.json keys consumed by the later UI PRs.

How to use

There is nothing to operate in this PR. To validate it in isolation:

bun install
bun run db:generate   # expect no drift against the committed snapshots
bun run db:migrate    # applies cleanly from a fresh database and from current main
bun run typecheck     # @quackback/ids and @quackback/db

Safety

• Purely additive at the database level; no destructive changes to existing data.
• One migration is a rename (0113_integration_channelid_backfill.sql → 0116_…) produced by the consolidation; the chain and journal are internally consistent.

Verification

• bun run db:generate reports no drift; bun run db:migrate applies cleanly; bun run typecheck passes for the two packages.

---

📚 This is a stacked series — please review & merge in order

These 10 PRs are split by concern and ordered by dependency. Each is opened against main, so until the PRs before it have merged, a PR's diff is cumulative (it also contains the earlier batches). As the earlier PRs merge and we rebase the next branch onto main, each diff reduces to just its own batch. Merging all 10 in order reproduces our integrated branch exactly (verified: the cumulative tip of the series is byte-identical to it).

Order (by branch):

1. 01-data-model-foundation — data model, TypeIDs, migrations
2. 02-rbac-authz-teams — RBAC, teams, organisation & auth surfaces
3. 03-events-audit-webhooks — event dispatch, audit log, webhooks, notifications
4. 04-ticketing-crm-core — ticketing / CRM core
5. 05-sla-inboxes-routing — SLA policies, inboxes, business hours, routing
6. 06-github-sync-and-ticket-email — GitHub ticket sync, ticket email, integration platform
7. 07-widget-profiles — scoped widget profiles + ticket submission
8. 08-api-openapi-mcp — OpenAPI surface, MCP tools, conversation actions, API keys
9. 09-content-visibility — changelog/help-centre visibility, segments, portal tabs
10. 10-test-coverage — broad unit/integration test suite + supporting infra

Part of the roadmap: #283

[CLAassistant]

All committers have signed the CLA.