feat: ticketing sync workers with idempotent import and orphan flagging (phase 6)

- task domain model + exhaustive §4.4 status machine tests (single source of truth)
- per-customer polling workers reconciled every 30s from the customers
  collection; panic-safe runs; manual sync-now trigger; status provider
  for the admin panel
- §5.3 upsert keyed on (system, key, customerId): refreshes content while
  status=imported, records upstream_changed timeline + notification after
- attachments cached into GridFS via connector-authorized downloads
- orphaned tickets flagged with timeline + consultant notification, never
  deleted; idempotent across polls
- consultant identity from users.extra.ticketingIdentities per system
- notifications store (insert/list/unread-count/mark-read)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

cmd/app/main.go

@@ -3,6 +3,7 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"log/slog"
 	"os"
@@ -12,10 +13,13 @@ import (
 
 	"bountyboard/internal/auth"
 	"bountyboard/internal/config"
+	"bountyboard/internal/crypto"
+	"bountyboard/internal/domain"
 	"bountyboard/internal/files"
 	httpx "bountyboard/internal/http"
 	"bountyboard/internal/metrics"
 	"bountyboard/internal/store"
+	syncpkg "bountyboard/internal/sync"
 )
 
 func main() {
@@ -57,12 +61,33 @@ func run() error {
 	}
 
 	reg := metrics.NewRegistry()
-	srv := httpx.New(cfg, log, reg, st, files.NewStore(st.DB, cfg.MaxUploadMB))
+	fileStore := files.NewStore(st.DB, cfg.MaxUploadMB)
+	srv := httpx.New(cfg, log, reg, st, fileStore)
 	srv.AddReadinessCheck(httpx.ReadinessCheck{
 		Name:     "mongo",
 		Required: true,
 		Probe:    st.Ping,
 	})
 
+	syncMgr := syncpkg.NewManager(st, fileStore, log, reg,
+		func(c *domain.Customer) (syncpkg.Credentials, error) {
+			if c.Ticketing.CredentialsEnc == "" {
+				return syncpkg.Credentials{}, nil
+			}
+			plain, err := crypto.Open(cfg.CredentialsEncKey, c.Ticketing.CredentialsEnc)
+			if err != nil {
+				return nil, err
+			}
+			var creds syncpkg.Credentials
+			if err := json.Unmarshal(plain, &creds); err != nil {
+				return nil, err
+			}
+			return creds, nil
+		},
+		srv.Publish)
+	srv.SetSyncStatusProvider(syncMgr)
+	srv.SetSyncTrigger(syncMgr.SyncNow)
+	go syncMgr.Run(ctx)
+
 	return srv.Run(ctx)
 }