feat: harden admin auth and ticket workflows

- add rotating admin refresh tokens and password gates\n- expand ticket galleries, exports, and client resources\n- improve IP allocation auditing and dashboard data\n- enforce encrypted client access tokens on public routes

database/migrations/2026_10_16_000001_add_email_cc_bcc_to_ip_pool_logs.php

@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('ip_pool_logs', function (Blueprint $table) {
+            $table->text('email_cc')->nullable()->after('email_to');
+            $table->text('email_bcc')->nullable()->after('email_cc');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('ip_pool_logs', function (Blueprint $table) {
+            $table->dropColumn(['email_cc', 'email_bcc']);
+        });
+    }
+};

database/migrations/2026_10_16_000002_move_ticket_gallery_to_private_disk.php

@@ -0,0 +1,18 @@
+<?php
+
+use App\Models\Ticket;
+use App\Support\TicketGallery;
+use Illuminate\Database\Migrations\Migration;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Ticket::query()
+            ->whereNotNull('gallery')
+            ->where('gallery', 'like', '%/storage/%')
+            ->chunkById(100, fn ($tickets) => $tickets->each(fn (Ticket $ticket) => TicketGallery::moveLegacyToPrivate($ticket)));
+    }
+
+    public function down(): void {}
+};

database/migrations/2026_10_17_000001_create_admin_refresh_tokens_table.php

@@ -0,0 +1,24 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('admin_refresh_tokens', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('user_id')->constrained('user')->cascadeOnDelete();
+            $table->string('token', 64)->unique();
+            $table->timestamp('expires_at');
+            $table->timestamps();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('admin_refresh_tokens');
+    }
+};