Backend auth, ticket assignment, soft-delete, queue concurrency

[Jambox11]

Summary

Adds JWT per-token revocation, support ticket assignment with audit logging, global Prisma soft-delete filtering with admin bypass, and per-queue BullMQ concurrency tuning with observability.

Changes

InsurNiffy#875 — Prisma soft-delete middleware

• Global automatic filtering to exclude rows with deletedAt != null from findMany/findFirst/findUnique
• AsyncLocalStorage-based context to track soft-delete bypass per request
• Admin queries can bypass filtering with prisma.withSoftDeleteBypass(async () => {...})
• Applies to Claim, Vote, Policy, ClaimComment models
• Includes comprehensive tests for filtered/unfiltered queries

InsurNiffy#874 — BullMQ per-queue concurrency configuration

• QUEUE_CONCURRENCY_MAP environment variable for fine-grained per-queue control
• Format: tx-submit=1,claim-events=5,claim-payouts=3
• Defaults: tx-submit=1 (nonce-safe), claim-events=5, claim-payouts=3
• Added bullmq_queue_active_workers Prometheus gauge per queue for Grafana
• Metrics emitted every 10s per worker with active job count
• TxSubmitWorker updated to use configured concurrency
• startClaimEventsWorker accepts optional concurrencyMapStr parameter
• Documentation in backend/docs/queue-concurrency.md

InsurNiffy#872 — Redis-backed JWT token blacklist

• TokenBlacklistService for per-JWT revocation without rotating signing secret
• JWT strategy checks Redis blacklist before accepting tokens
• POST /admin/auth/revoke accepts { jti, expiresAt } to revoke individual tokens
• Blacklist entries expire automatically when token would have expired
• Non-blacklisted tokens work normally; blacklisted tokens rejected with 401
• Immutable audit trail for all revocations
• Tests cover blacklist state, expiry timing, and strategy validation

InsurNiffy#873 — Support ticket assignment

• Added assignedTo: String? to SupportTicket model (null = unassigned)
• Index on assignedTo for efficient filtering
• PATCH /admin/support/tickets/:id/assign to assign/unassign tickets
• GET /admin/support/tickets with optional ?assignedTo= filter
• Audit log records assignment changes (from/to assignee, timestamp)
• mapToResponse includes assignedTo in API response
• Tests verify assignment state, audit logging, and filtering

Closes InsurNiffy#875, Closes InsurNiffy#874, Closes InsurNiffy#872, Closes InsurNiffy#873