Ticket links can target inaccessible tickets

Ticket link creation resolves target refs without checking whether the caller can access the target ticket.

Affected areas:

• apps/api/src/routes/ticketLinks.ts
• apps/api/src/services/ticketLinkService.ts

Impact:

• A user can link to private/non-member tickets.
• Returned link data and activity can leak target title, status, priority, and assignee.

Expected:

• Target ticket must be visible to the caller.
• Caller must either be a member of the target project or the target must be a public ticket in a public project.

Acceptance criteria:

• Pass userID into target ref resolution.
• Enforce target visibility/membership before creating links.
• Add tests for private project targets and private tickets inside public projects.