fix: bootstrap blocker + 4 security bugs

- Bootstrap (critical): settings/create/index no longer 403 on fresh install.
  Site admins (admin/super_admin) can access settings when 0 groups exist.
  First group creation seeds default priorities (Low/Medium/High/Urgent).
  Index shows friendly first-run splash. Create shows warning + settings link.

- Internal notes leak (high): submitters can no longer receive is_internal
  messages via ticket show, index detail panel, or any Inertia prop.
  filterMessagesForRole() strips internal notes for non-agents.

- Arbitrary assignee (med/high): update() now validates assigned_to against
  actual agent-access users for the ticket's group server-side.

- Cross-group priority/project forgery (medium): store() and update() now
  verify priority_id and project_id belong to the ticket's own group (or
  are global for priorities).

- Foreign message_id on attachment upload (medium): message_id is now
  validated to belong to the current ticket, not just any message row.

resources/js/Pages/Ticketing/Settings.vue

@@ -5,6 +5,15 @@
       <h1 class="text-2xl font-bold text-gray-900 dark:text-white mt-2">Ticketing Settings</h1>
     </div>
 
+    <!-- Bootstrap banner -->
+    <div v-if="isBootstrap" class="mb-6 px-5 py-4 bg-amber-50 dark:bg-amber-900/30 border border-amber-300 dark:border-amber-600 rounded-xl">
+      <h2 class="text-base font-semibold text-amber-800 dark:text-amber-200 mb-1">🚀 First-Run Setup</h2>
+      <p class="text-sm text-amber-700 dark:text-amber-300">
+        No groups exist yet. Create your first group below to get started.
+        Default priorities (Low, Medium, High, Urgent) will be seeded automatically.
+      </p>
+    </div>
+
     <!-- Flash message -->
     <div v-if="$page.props.flash?.success" class="mb-4 px-4 py-2 bg-green-50 dark:bg-green-900/30 border border-green-200 dark:border-green-700 text-green-700 dark:text-green-300 rounded-lg text-sm">
       {{ $page.props.flash.success }}
@@ -239,6 +248,8 @@ const props = defineProps({
   agents: Array,
   priorities: Array,
   myGroupIds: Array,
+  isBootstrap: Boolean,
+  isSiteAdmin: Boolean,
 })
 
 const activeTab = ref('groups')