fix(fusion_helpdesk): define missing _norm_email helper (NameError on every inbox endpoint)

The IDOR-hardening commit (fb345be3) referenced _norm_email in submit()
and _identity() but never defined or imported it, so every inbox endpoint
(my_tickets, ticket_detail, ticket_reply, unread_count) and the New-ticket
submit path raised NameError at runtime — surfaced as a JSON-RPC error in
the dialog. The smoke test missed it because it replicated build_scope_domain
directly instead of calling the controller.

Add _norm_email(*candidates) to utils.py (returns the first candidate that
email_normalize accepts, else '' — rejecting self-set wildcards like '%' so
the inbox scope key can't be widened), import it in main.py, drop the now-unused
email_normalize import there, and add unit tests + a guard that the controller
namespace resolves the name.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fusion_helpdesk/tests/test_utils.py

@@ -14,6 +14,7 @@ from odoo.addons.fusion_helpdesk.utils import (
     build_scope_domain,
     is_public_message,
     compute_unread_count,
+    _norm_email,
 )
 
 
@@ -103,3 +104,28 @@ class TestMessageFilterAndUnread(TransactionCase):
     def test_unread_count_unseen_ticket_counts(self):
         tickets = [{'id': 9, 'last_support_msg_id': 4}]
         self.assertEqual(compute_unread_count(tickets, {}), 1)
+
+
+@tagged('post_install', '-at_install', 'fusion_helpdesk')
+class TestNormEmail(TransactionCase):
+
+    def test_valid_email_is_normalised_lowercase(self):
+        self.assertEqual(_norm_email('John@Entech.COM'), 'john@entech.com')
+
+    def test_first_valid_candidate_wins(self):
+        # confirmed reply email empty -> fall back to the next valid one
+        self.assertEqual(_norm_email('', 'not an email', 'jane@x.com'), 'jane@x.com')
+
+    def test_wildcard_is_rejected(self):
+        # IDOR guard: a self-set '%' must not survive as a scope key
+        self.assertEqual(_norm_email('%'), '')
+
+    def test_non_email_login_falls_through_to_empty(self):
+        self.assertEqual(_norm_email('admin', 'also-not-email', ''), '')
+
+    def test_controller_namespace_resolves_norm_email(self):
+        # Regression: _norm_email was called in controllers/main.py
+        # (submit + _identity) but never imported/defined -> NameError on
+        # every inbox endpoint. Guard that the name is resolvable there.
+        from odoo.addons.fusion_helpdesk.controllers import main
+        self.assertTrue(hasattr(main, '_norm_email'))