fix: bootstrap blocker + 4 security bugs

- Bootstrap (critical): settings/create/index no longer 403 on fresh install.
  Site admins (admin/super_admin) can access settings when 0 groups exist.
  First group creation seeds default priorities (Low/Medium/High/Urgent).
  Index shows friendly first-run splash. Create shows warning + settings link.

- Internal notes leak (high): submitters can no longer receive is_internal
  messages via ticket show, index detail panel, or any Inertia prop.
  filterMessagesForRole() strips internal notes for non-agents.

- Arbitrary assignee (med/high): update() now validates assigned_to against
  actual agent-access users for the ticket's group server-side.

- Cross-group priority/project forgery (medium): store() and update() now
  verify priority_id and project_id belong to the ticket's own group (or
  are global for priorities).

- Foreign message_id on attachment upload (medium): message_id is now
  validated to belong to the current ticket, not just any message row.

src/Http/Controllers/TicketAttachmentController.php

@@ -31,7 +31,21 @@ class TicketAttachmentController extends Controller
 
         $request->validate([
             'file' => 'required|file|max:' . (self::MAX_SIZE_MB * 1024),
-            'message_id' => 'nullable|exists:ticket_messages,id',
+            // Bug #5: message_id must belong to THIS ticket, not any arbitrary message
+            'message_id' => [
+                'nullable',
+                'integer',
+                function ($attribute, $value, $fail) use ($ticket) {
+                    if ($value !== null) {
+                        $exists = \Dashboard\Ticketing\Models\TicketMessage::where('id', $value)
+                            ->where('ticket_id', $ticket->id)
+                            ->exists();
+                        if (!$exists) {
+                            $fail('The message does not belong to this ticket.');
+                        }
+                    }
+                },
+            ],
         ]);
 
         $file = $request->file('file');