fix: bootstrap blocker + 4 security bugs

- Bootstrap (critical): settings/create/index no longer 403 on fresh install.
  Site admins (admin/super_admin) can access settings when 0 groups exist.
  First group creation seeds default priorities (Low/Medium/High/Urgent).
  Index shows friendly first-run splash. Create shows warning + settings link.

- Internal notes leak (high): submitters can no longer receive is_internal
  messages via ticket show, index detail panel, or any Inertia prop.
  filterMessagesForRole() strips internal notes for non-agents.

- Arbitrary assignee (med/high): update() now validates assigned_to against
  actual agent-access users for the ticket's group server-side.

- Cross-group priority/project forgery (medium): store() and update() now
  verify priority_id and project_id belong to the ticket's own group (or
  are global for priorities).

- Foreign message_id on attachment upload (medium): message_id is now
  validated to belong to the current ticket, not just any message row.

resources/js/Pages/Ticketing/Index.vue

@@ -1,5 +1,17 @@
 <template>
   <div class="flex h-screen overflow-hidden bg-slate-100 text-slate-900 dark:bg-slate-950 dark:text-slate-100">
+
+    <!-- Bootstrap / first-run state -->
+    <div v-if="isBootstrap" class="flex flex-col items-center justify-center w-full h-full text-center px-6">
+      <div class="max-w-md">
+        <div class="text-5xl mb-4">🎫</div>
+        <h2 class="text-2xl font-bold text-slate-800 dark:text-slate-100 mb-2">Ticketing isn’t set up yet</h2>
+        <p class="text-slate-500 dark:text-slate-400 mb-6">Create your first group in Settings to get started. Default priorities will be seeded automatically.</p>
+        <Link :href="route('ticketing.settings')" class="inline-block bg-indigo-600 text-white px-5 py-2.5 rounded-xl text-sm font-medium hover:bg-indigo-700 transition">Go to Settings</Link>
+      </div>
+    </div>
+
+    <template v-else>
     <aside class="hidden w-72 shrink-0 border-r border-slate-200 bg-white/90 backdrop-blur dark:border-slate-800 dark:bg-slate-900/90 lg:flex lg:flex-col">
       <div class="border-b border-slate-200 p-5 dark:border-slate-800">
         <div class="flex items-center justify-between gap-3">
@@ -408,6 +420,7 @@
         </div>
       </template>
     </section>
+  </template>
   </div>
 </template>
 
@@ -425,6 +438,7 @@ const props = defineProps({
   ticketDetail: Object,
   detailAgents: Array,
   viewCounts: Object,
+  isBootstrap: Boolean,
 })
 
 const search = ref('')