fix(helpdesk): address code review findings for ticket files

- Use Router::download() instead of die() to avoid Analyzer rejection
- Add 5 PHPUnit tests for BcSoapGateway::getTicketFile() (F-001)
- Add test for file metadata on communication entries (F-002)
- Add rel=noopener noreferrer on target=_blank links (F-003)
- Add aria-hidden on download icon, aria-label on image link (F-003)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

modules/helpdesk/pages/helpdesk/ticket-file-data().php

@@ -46,41 +46,6 @@ if (!$result['ok'] || !isset($result['data'])) {
 
 $data = $result['data'];
 
-// Derive MIME type from filename extension
-$mimeMap = [
-    'jpg' => 'image/jpeg',
-    'jpeg' => 'image/jpeg',
-    'png' => 'image/png',
-    'gif' => 'image/gif',
-    'svg' => 'image/svg+xml',
-    'bmp' => 'image/bmp',
-    'ico' => 'image/x-icon',
-    'pdf' => 'application/pdf',
-    'doc' => 'application/msword',
-    'docx' => 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
-    'xls' => 'application/vnd.ms-excel',
-    'xlsx' => 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
-    'zip' => 'application/zip',
-    'txt' => 'text/plain',
-    'csv' => 'text/csv',
-];
-
-$ext = $filename !== '' ? strtolower(pathinfo($filename, PATHINFO_EXTENSION)) : '';
-$mimeType = $mimeMap[$ext] ?? 'application/octet-stream';
 $displayFilename = $filename !== '' ? $filename : 'attachment-' . $entryNo;
 
-// Image types can be displayed inline, others force download
-$imageExtensions = ['jpg', 'jpeg', 'png', 'gif', 'bmp', 'ico'];
-$disposition = in_array($ext, $imageExtensions, true) ? 'inline' : 'attachment';
-
-header('Content-Type: ' . $mimeType);
-header('Content-Disposition: ' . $disposition . '; filename="' . addcslashes($displayFilename, '"\\') . '"');
-header('Content-Length: ' . strlen($data));
-header('Cache-Control: private, max-age=3600');
-header('Content-Transfer-Encoding: Binary');
-
-while (ob_get_level()) {
-    ob_end_clean();
-}
-
-die($data);
+Router::download($displayFilename, $data);