feat: add Zammad ticket integration

[Optic00]

Summary

• Add administrator-managed Zammad connections using encrypted API tokens or the native OAuth flow.
• Create new tickets or link existing ones from Windshift items, with durable mappings, group scoping, correlation-based duplicate protection, polling, manual refresh, owner/group/state updates, and optional closed-state workflow mapping.
• Add permission-checked return links from Zammad to the current Windshift item plus setup and operating documentation.
• Harden outbound requests with the existing public-address SSRF policy, redirect checks, bounded responses, and sanitized errors.

Scope

This implements the core integration proposed in #234. Comment and attachment synchronization, arbitrary field synchronization, and webhooks remain out of scope.

Stacked follow-up: Optic00#1 adds the workspace dashboard and item-level observability UI without expanding this core integration diff.

Validation

• go test ./...
• Frontend, from frontend/:
  • npm run check
  • npm run typecheck
  • npm run test:run
  • npm run build
• Manual end-to-end use against a private Zammad/Windshift lab installation

The integration has not been exercised in production. Zammad is not yet part of the automated end-to-end suite.