Ticket mutations allow cross-project UUIDs

Ticket create, patch, and move accept raw UUID references without validating they belong to the current project.

Affected inputs:

• statusID
• labelIDs
• assigneeID
• beforeID
• afterID

Affected areas:

• apps/api/src/routes/tickets.ts
• apps/api/src/services/ticketService.ts

Impact:

• Tickets can use another project's statuses or labels.
• Tickets can be assigned to users who are not members of the project.
• Kanban moves can use neighbour IDs from another project/status context.

Expected:

• Every referenced ID is scoped to the current ticket project.
• Invalid or cross-project references return a clear 400/404.

Acceptance criteria:

• Add service-level validation before create/patch/move writes.
• Add tests for cross-project status, label, assignee, and move-neighbour IDs.