Read the attachment disk from config, not env (secrets S3)

The three reads were `config('ticketing.storage_disk', env('TICKETING_STORAGE_DISK', 'local'))`,
but this package had no config file at all — so the config() lookup was always
null and env() was the only reader.

Once `config:cache` runs in production, a runtime env() returns NULL. Every
ticket attachment would have silently gone to the 'local' disk, ignoring
whatever the operator had configured — and previously-stored attachments would
404 because show() looked on the wrong disk.

Verified rather than assumed: with TICKETING_STORAGE_DISK=s3proof set,
config() returned 's3proof' both cached and uncached, while env() returned
's3proof' uncached and NULL cached.

Adds config/ticketing.php + mergeConfigFrom so the value is captured at
cache time, and drops the env() fallbacks.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

config/ticketing.php

@@ -0,0 +1,15 @@
+<?php
+
+return [
+
+    /*
+     * The filesystem disk ticket attachments are stored on. Read at runtime via
+     * config('ticketing.storage_disk') — NOT env() — so it survives config:cache
+     * in production. Before this file existed the controllers read
+     * env('TICKETING_STORAGE_DISK') directly, which returns null once the config
+     * is cached, silently forcing every attachment onto the 'local' disk and
+     * orphaning anything an operator had pointed elsewhere (secrets spec S3).
+     */
+    'storage_disk' => env('TICKETING_STORAGE_DISK', 'local'),
+
+];