feat(admin): public-ticket guest policy settings endpoints (Task 6.3)

[mpge]

Summary

Adds `GET` + `PUT /support/admin/settings/public-tickets` so admins can switch the public-ticket guest-policy mode at runtime via the shared `Admin/Settings/PublicTickets.vue` page. Closes Plan Task 6.3 for the .NET greenfield host adapter.

The existing `SettingsService` + `EscalatedSettings` model already provide the key/value backbone — this PR only adds the two public-tickets endpoints + tests on top. No migration or schema changes needed.

What's added

Three settings keys back the policy:

• `guest_policy_mode` — enum: `unassigned | guest_user | prompt_signup`
• `guest_policy_user_id` — required when mode = `guest_user`
• `guest_policy_signup_url_template` — optional when mode = `prompt_signup`

Consumers (widget controller, inbound router) read via `SettingsService.GetAsync` so mode switches don't require a redeploy.

Validation + cleanup semantics

• PUT coerces unknown mode values to `unassigned` (never 500s on bad input).
• Clears mode-specific fields on mode switch to prevent stale `guest_user_id` leaking back into `prompt_signup` behavior, and vice versa.
• Truncates `guest_policy_signup_url_template` at 500 chars.
• Zero / negative `guest_policy_user_id` stored as empty string; GET surfaces as `null`.

Wire format

`PublicTicketsSettingsRequest` uses `[JsonPropertyName]` snake_case attributes so the wire format matches what the shared Vue page sends — consistent with the Symfony port (`escalated-symfony/feat/settings-service`).

Test plan

8 xUnit tests in `PublicTicketsSettingsTests`:

• GET defaults to `unassigned` when nothing written
• PUT `guest_user` persists user id, clears template
• PUT `prompt_signup` persists template, clears user id
• Mode switch `guest_user → unassigned` clears user id
• Unknown mode value coerces to `unassigned`
• Long signup template truncated at 500 chars
• Zero `guest_policy_user_id` stored as empty (surfaces null on GET)
• Multiple consecutive PUTs — GET returns the latest
• CI runs `dotnet test` — no local toolchain to validate; relies on CI

Follow-ups (per other frameworks in the rollout)

• Spring, Go, Phoenix still need equivalent endpoints for greenfield Task 6.3 parity — each has different infra requirements (Spring has JPA settings pending, Go has no settings model at all, Phoenix has no shared settings store yet).