Uploads from soft-deleted tickets stay public

Attachment access checks ignore tickets.deletedAt, so uploads from soft-deleted public tickets can still be fetched anonymously.

Affected area:

• apps/api/src/services/attachmentService.ts

Impact:

• Deleted ticket content may remain publicly accessible through /uploads/:storageKey.

Expected:

• Uploads attached to soft-deleted tickets return 404 unless the ticket is restored.

Acceptance criteria:

• Add tickets.deletedAt IS NULL to attachment access resolution.
• Add test: public ticket attachment is accessible before delete and 404 after soft delete.