feat: ticketing system with technical/sales roles and department routing

Backend:
- Added TECHNICAL and SALES roles to UserRole enum
- Added TicketDepartment, TicketStatus, TicketPriority enums
- Created Ticket and TicketMessage entities with relationships
- Created TicketsModule with full CRUD service and controller
- Ticket routing: users create tickets to technical/sales departments
- Staff reply updates status (answered), user reply sets waiting
- Role-based access: technical staff sees technical tickets, sales sees sales tickets
- Admin sees all tickets with stats (total, open, avg response time)
- Updated access control: technical role has admin-level access (except role change)
- Sales role can view users and handle sales tickets
- Clusters controller: technical role can manage clusters/pools
- Users controller: technical/sales can view users, only admin changes roles

Frontend:
- New user ticket pages: list (with create form) + detail (chat-style messages)
- Staff ticket panel: filtered by department with status filters
- Admin all-tickets page with statistics dashboard and department/status filters
- Updated sidebar: role-based nav items (admin/technical/sales sections)
- Role badges in header for technical (blue) and sales (green)
- Admin users page: new roles in dropdowns, role change restricted to admin only
- Deploy page: technical role gets cluster selection access like admin

backend/src/applications/applications.service.ts

@@ -21,9 +21,9 @@ export class ApplicationsService {
   ) {}
 
   async create(userId: string, dto: CreateApplicationDto, userRole?: string): Promise<Application> {
-    // Only admin users can manually select cluster or pool
+    // Only admin/technical users can manually select cluster or pool
     // Regular users always get the default cluster assignment
-    if (userRole !== UserRole.ADMIN) {
+    if (userRole !== UserRole.ADMIN && userRole !== UserRole.TECHNICAL) {
       if (dto.clusterId || dto.poolId) {
         this.logger.warn(`Non-admin user ${userId} attempted manual cluster/pool selection — ignoring`);
       }