feat: harden admin auth and ticket workflows

- add rotating admin refresh tokens and password gates\n- expand ticket galleries, exports, and client resources\n- improve IP allocation auditing and dashboard data\n- enforce encrypted client access tokens on public routes

app/Http/Resources/Api/Client/Ticket/ClientTicketReplyResource.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Http\Resources\Api\Client\Ticket;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class ClientTicketReplyResource extends JsonResource
+{
+    public function toArray(Request $request): array
+    {
+        $fromStaff = $this->user_id !== null;
+
+        return [
+            'message'     => $this->message,
+            'sender_type' => $fromStaff ? 'staff' : 'client',
+            'sender_name' => $fromStaff ? (optional($this->user)->name ?: 'Nhân viên hỗ trợ') : 'Khách hàng',
+            'sender_role' => $fromStaff ? 'Nhân viên hỗ trợ' : 'Khách hàng',
+            'created_at'  => $this->created_at,
+        ];
+    }
+}

app/Http/Resources/Api/Client/Ticket/ClientTicketResource.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Http\Resources\Api\Client\Ticket;
+
+use App\Support\TicketGallery;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class ClientTicketResource extends JsonResource
+{
+    public function toArray(Request $request): array
+    {
+        return [
+            'ticket_num'  => $this->ticket_num,
+            'subject'     => $this->subject,
+            'description' => $this->description,
+            'status'      => $this->status,
+            'room'        => $this->room,
+            'priority'    => $this->resource->priority(),
+            'gallery'     => TicketGallery::clientUrls($this->resource),
+            'customer'    => $this->whenLoaded('customer', fn () => ['fullname' => $this->customer->fullname]),
+            'replies'     => ClientTicketReplyResource::collection($this->whenLoaded('reply')),
+            'created_at'  => $this->created_at,
+            'updated_at'  => $this->updated_at,
+        ];
+    }
+}

app/Http/Resources/Api/Ticket/TicketResource.php

@@ -2,6 +2,7 @@
 
 namespace App\Http\Resources\Api\Ticket;
 
+use App\Support\TicketGallery;
 use Illuminate\Http\Request;
 use Illuminate\Http\Resources\Json\JsonResource;
 
@@ -18,7 +19,7 @@ class TicketResource extends JsonResource
             'status'      => $this->status,
             'room'        => $this->room,
             'data'        => $this->data ? (is_string($this->data) ? json_decode($this->data, true) : $this->data) : null,
-            'gallery'     => $this->gallery ?? [],
+            'gallery'     => TicketGallery::adminUrls($this->resource),
             'customer_id' => $this->customer_id,
             'customer'    => $this->whenLoaded('customer', fn() => [
                 'id'       => $this->customer->id,