feat(fusion_helpdesk): customer follow-up + embedded ticket inbox

Squash-merge of feat/helpdesk-customer-followup. The billing and
fusion_login_audit work from that branch is already on main (landed
separately); this lands only the helpdesk feature.

- Identity keystone: submit() forwards partner_email/partner_name/
  x_fc_client_label so the central Helpdesk find-or-creates the customer
  partner and subscribes them as a follower (enables reply emails + magic link).
- Embedded in-app 'My Tickets' inbox: server-side scoped read/reply RPC
  endpoints, per-user seen tracking (fusion.helpdesk.ticket.seen), systray
  unread badge. Defense-in-depth scope domain + _norm_email normalisation
  (wildcard emails cannot widen scope).
- fusion_helpdesk_central: x_fc_client_label field + list/search views +
  branded acknowledgement email template.
- Deployed and smoke-tested live: nexa central 19.0.1.1.0, entech client
  19.0.1.4.1 (requires Contact Creation on the central service account).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fusion_helpdesk/security/fusion_helpdesk_groups.xml

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+    Copyright 2026 Nexa Systems Inc.
+    License OPL-1
+-->
+<odoo>
+    <!--
+        Deployment-level admin for the embedded ticket inbox. Members see
+        ALL tickets filed from this deployment (scoped by x_fc_client_label)
+        in the "My Tickets" tab; non-members see only their own. The gate is
+        enforced server-side in the controller via has_group().
+        Odoo 19: res.groups has NO `users`/`category_id` fields — keep minimal.
+    -->
+    <record id="group_reporter_admin" model="res.groups">
+        <field name="name">Helpdesk Reporter Admin</field>
+        <field name="comment">Can view all tickets filed from this deployment in the in-app helpdesk inbox.</field>
+    </record>
+</odoo>

fusion_helpdesk/security/ir.model.access.csv

@@ -1 +1,2 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_fhd_seen_user,fusion.helpdesk.ticket.seen.user,model_fusion_helpdesk_ticket_seen,base.group_user,1,1,1,1