feat(tickets): ticketing/CRM core — tickets, contacts, statuses, subscriptions

[melihsunbul]

What

The ticketing / CRM core: tickets, ticket statuses, ticket subscriptions, contacts, and a unified Customers workspace. This is the headline capability of the contribution.

Concepts

• Ticket — a support request with a status, optional assignee/team, priority and a thread of public replies and internal notes.
• Ticket status — a workspace-configurable lifecycle state (for example Open → Pending → Solved).
• Contact — an external person a ticket can be attributed to, independent of whether they ever sign in.
• Customers (a deliberate unification) — the Customers workspace presents people (portal users and contacts) together with the organisations they belong to, behind one navigation area. We merged the existing user/people notion with the new contact and organisation concepts rather than introducing a parallel, competing entity — this keeps the model lean and avoids two overlapping "who is this person" surfaces.
• Subscription — who is notified about a ticket's activity.

How it works

• Domain (domains/tickets/) — ticket.service.ts covers create, reply, note, assign, priority, status and resolve, with optimistic concurrency (409 TICKET_STALE). Supported by domains/customers/, domains/statuses/, domains/subscriptions/.
• API — /api/v1/tickets, /ticket-statuses, /contacts: CRUD, thread create/update/delete, list with requester scoping and CORS, attachment-aware handlers; extensive coverage tests.
• Server functions — functions/tickets.ts, customers, contacts.
• UI — /admin/tickets queue and detail (components/admin/tickets/: side panels, activity, editable description, audit summaries); /admin/tickets/new; the Customers routes (/admin/customers with people/organisations/segments, and /admin/contacts) surfacing permission-gated ticket counts and segment/organisation attributes.
• Backfill — a one-shot script links existing portal users to contacts and backfills tickets.requesterContactId (documented in CLAUDE.md).

How to use

• Create a ticket: /admin/tickets/new, or via POST /api/v1/tickets.
• Work the queue: /admin/tickets — open a ticket to reply (public) or add a note (internal), assign it, set priority, and change status.
• Configure statuses: ticket statuses are workspace-configurable so the lifecycle matches your process.
• Browse customers: /admin/customers — view people and organisations, their linked tickets, and segment membership.
• Migrating existing data: run bun apps/web/scripts/backfill-ticket-contacts.ts --dry-run first, then without the flag.

Safety

• Ticket reads/writes are permission-gated (RBAC from PR 02); requester-owned scoping prevents portal users from seeing others' tickets.
• Status transitions use optimistic concurrency to avoid lost updates under concurrent edits.

Verification

• bun run typecheck, bun run lint; ticket.service.test.ts, tickets-core/threads coverage and functions/tickets tests (included).

Depends on 03-events-audit-webhooks.

---

📚 This is a stacked series — please review & merge in order

These 10 PRs are split by concern and ordered by dependency. Each is opened against main, so until the PRs before it have merged, a PR's diff is cumulative (it also contains the earlier batches). As the earlier PRs merge and we rebase the next branch onto main, each diff reduces to just its own batch. Merging all 10 in order reproduces our integrated branch exactly (verified: the cumulative tip of the series is byte-identical to it).

Order (by branch):

1. 01-data-model-foundation — data model, TypeIDs, migrations
2. 02-rbac-authz-teams — RBAC, teams, organisation & auth surfaces
3. 03-events-audit-webhooks — event dispatch, audit log, webhooks, notifications
4. 04-ticketing-crm-core — ticketing / CRM core
5. 05-sla-inboxes-routing — SLA policies, inboxes, business hours, routing
6. 06-github-sync-and-ticket-email — GitHub ticket sync, ticket email, integration platform
7. 07-widget-profiles — scoped widget profiles + ticket submission
8. 08-api-openapi-mcp — OpenAPI surface, MCP tools, conversation actions, API keys
9. 09-content-visibility — changelog/help-centre visibility, segments, portal tabs
10. 10-test-coverage — broad unit/integration test suite + supporting infra

Part of the roadmap: #283

[CLAassistant]

All committers have signed the CLA.