Sub-ticket of PLUTO-176 Permission gate: resolve requireCap (manageUsers vs new supportTickets cap) + audit design-ping (schema+authz+email triple-trigger) BEFORE impl · pluto