Extend support-api to full ticket CRUD (status, private comments, notify-list) - EVO-52

Elazar directive, EVO-52 umbrella (sub-items MARS-467/VENUS-252/PLUTO-563). Extend src/app/api/internal/support-reply + support-reply-core.ts (PLUTO-444 foundation, bearer-gated) to full CRUD: (1) status transitions incl. close/resolve via API; (2) private comment type visible ONLY to Elazar + the ticket's stakeholder agent, NEVER the end-user reporter - new visibility predicate on ticket comments; (3) notify-list (agent name+email) that fires on ticket events, likely riding sendAdminEmail per existing outbound-email rule. Hard constraint from Elazar: agents must NEVER write directly to the ticket DB, NEVER drive a ticket via chrome-mcp, NEVER ask a human to do it manually - everything through this API. Trigger case (venus): SOP-VENUS-15 solved but stuck open/un-notified because coder-venus-cc had no API path to close/notify - same gap exists on pluto's support-reply API today (reply-only, no status/private-comment/notify-list ops). Class-A: new authz predicate for private-comment visibility gate. Pre-impl audit-pluto-ca design-ping required before implementation.