feat: add ticket submission for partners and NPTS

[SJAryan]

Partners and NPTS members can submit tickets from the ITS dashboard and receive confirmation of the saved ticket number and initial status. Partners can select projects in their own organization; existing NPTS users (orgId: null) can select projects across all organizations.

Changes

• Add a reusable TicketForm with project selection, title/description validation, and a typed submit event for reuse by the widget workstream.
• Add GET /api/projects, returning project IDs and names according to the user's current database assignment. Missing/deleted accounts are denied; a null organization on an existing account means NPTS access.
• Add POST /api/tickets, validating input and checking current project access within the save transaction. The server assigns the author, initial open status, and timestamp; caller-supplied server fields are rejected.
• Disable automatic email OTP signup so an unknown email cannot register a new account with NPTS privileges. Provisioned NPTS and partner users can still sign in.
• Add the dashboard link, submission confirmation, retry/loading/empty states, isolated API/auth/component tests, and API documentation.

Validation

• pnpm test: 74 tests passed across 6 files.
• pnpm typecheck: passed.
• pnpm lint: passed.
• Manual local partner flow: signed in using email OTP, selected a partner project, submitted a ticket, and received confirmation for ticket Add project-specific requirements  #1. Read-only database verification confirmed its author, project ownership, and open status.
• Access tests cover NPTS submission across organizations, partner isolation, reassignment, missing accounts and invalid requests using disposable in-memory SQLite.
• Auth integration tests use real OTP login cookies through the actual authentication middleware and project/ticket handlers. They verify NPTS access, partner isolation, blocked signup, revoked/invalid sessions, and changes to account assignments using dummy configuration and mocked email. No tests send real email or create GitHub issues.

Scope and follow-up

Refs #5; implements the submission milestone (REQ-F-09) and the reusable form. The semester workstream remains open.

• Ticket lists/status views (REQ-F-08) and ticket editing remain follow-up work.
• GitHub issue creation/linking (REQ-F-14) is not wired up yet; githubIssueId remains null. Coordinate this integration before claiming the full integrated ticket flow is complete.
• Coordinate the initial open status and future transitions with the NPTS ticket workstream.
• Newly provisioned accounts default to NPTS when orgId is omitted: SQLite stores NULL. A regression test verifies a direct database insert, OTP login, and access across organizations. Assign partners an organization to restrict their access.
• No database schema/migration or dependency changes are included. Local environment settings, database files, and database backups are excluded.