feat(helpdesk): add Risk Radar dashboard with customer risk scoring

New portfolio view scoring customers 0-100 across five dimensions:
- Open pressure (30%): open + critical ticket count
- Trend (25%): net ticket flow (created - closed) in period
- SLA overdue (20%): tickets exceeding escalation targets
- Resolution time (15%): median hours to close (null = neutral)
- Inactivity (10%): age of oldest open ticket

Card grid with score badges (color-coded high/medium/low), metric
pills, driver bars. Click opens detail dialog with all dimensions
and open ticket list. Clientside search filter.

PBI_LV_Tickets with client-driven paging ($skip/$top, hardcap 5000).
Escalation definitions cached separately (30min TTL). Truncated
banner when data is capped.

New: RiskRadarService, getTicketsForRiskRadar(), 13 PHPUnit tests,
permission helpdesk.risk-radar.view, 2 routes, i18n de+en.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

db/init/init.sql

@@ -1551,7 +1551,7 @@ JOIN permissions p ON p.`key` IN (
   'mail_log.view', 'api_audit.view', 'system_audit.view', 'system_audit.purge',
   'stats.view', 'system_info.view',
   'roles.assign_all',
-  'helpdesk.access', 'helpdesk.settings.manage', 'helpdesk.team-workload.view'
+  'helpdesk.access', 'helpdesk.settings.manage', 'helpdesk.team-workload.view', 'helpdesk.risk-radar.view'
 )
 WHERE r.description IN ('Admin', 'Administrator') OR r.id = 1
 ON DUPLICATE KEY UPDATE role_id = role_id;

db/updates/2026-04-06-helpdesk-risk-radar-permission.sql

@@ -0,0 +1,9 @@
+-- Helpdesk module: assign risk radar permission to Admin role.
+-- Idempotent: safe to run multiple times.
+
+INSERT INTO `role_permissions` (`role_id`, `permission_id`, `created`)
+SELECT r.id, p.id, NOW()
+FROM roles r
+JOIN permissions p ON p.`key` = 'helpdesk.risk-radar.view'
+WHERE r.description IN ('Admin', 'Administrator') OR r.id = 1
+ON DUPLICATE KEY UPDATE role_id = role_id;