Admin can create a support ticket on behalf of another user

Today a support ticket can only be created by the person experiencing the problem: createSupportTicket stamps the reporter from the session, so an admin who hears about a problem by phone, email or in person has no way to file it as that user. The two workarounds are both wrong — file it under the admin's own name (the reporter, the notification email and every later thread reply point at the wrong person) or ask the user to re-report it themselves (which is what they already avoided by calling). Scope to decide before implementing: - reporter selection: admin picks the user; the ticket's reporterUserId is that user, not the admin. - the acting admin must be recorded separately and durably — a ticket whose reporter was set by someone else and does not say so is indistinguishable from a self-filed one, which corrupts every later read of who reported what. Needs its own column (createdOnBehalfByUserId), not just an appEvents row. - resolution email goes to the REPORTER, per the live-resolve rule (recipient re-resolved from the userId at send time, never a snapshotted address). - gate on the adminConsole capability, and note it is a capability check, not a scope check — decide whether an admin may file for ANY user or only users in their scope. - UI surface: /administrar/soporte, alongside the existing reply/close actions. - the scripted path (scripts/resolve-support-ticket.ts) already resolves on a user's behalf with an explicit --actor; this is the create-side counterpart and should stamp provenance the same way.