fix(fusion_helpdesk): close IDOR + reliability gaps from code review

- P0 IDOR: escape LIKE wildcards in build_scope_domain + normalise emails (email_normalize) on both write and scope sides, so a self-set email of '%' can no longer match every ticket in a deployment (+2 regression tests).
- Convert XML-RPC ProtocolError (central 502/503/429) to _RemoteError instead of a raw 500.
- _resolve_author: log + post as service account on failure instead of silently impersonating the ticket customer.
- _mark_seen now best-effort (runs after the remote post) so a bookkeeping failure can't report a successful reply as failed (no duplicate replies).
- Attachment loop catches network errors + reports failed count (no duplicate-ticket trap); dialog surfaces failures.
- console.error in JS catches for diagnosability.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fusion_helpdesk/tests/test_utils.py

@@ -68,6 +68,20 @@ class TestScopeDomain(TransactionCase):
         self.assertEqual(len(label_terms), 1)
         self.assertNotEqual(label_terms[0][2], '')
 
+    def test_wildcard_email_cannot_widen_scope(self):
+        # IDOR guard: a self-set email of '%' must NOT become a match-all
+        # =ilike term — the wildcard has to be escaped to a literal.
+        dom = build_scope_domain(label='ENTECH', email='%', is_admin=False)
+        email_terms = [t for t in dom if t[0] == 'partner_email']
+        self.assertEqual(len(email_terms), 1)
+        self.assertEqual(email_terms[0][2], '\\%',
+                         "'%' must be escaped so ILIKE matches it literally")
+
+    def test_underscore_in_real_email_is_escaped_but_preserved(self):
+        dom = build_scope_domain(label='ENTECH', email='john_doe@x.com', is_admin=False)
+        email_terms = [t for t in dom if t[0] == 'partner_email']
+        self.assertEqual(email_terms[0][2], 'john\\_doe@x.com')
+
 
 @tagged('post_install', '-at_install', 'fusion_helpdesk')
 class TestMessageFilterAndUnread(TransactionCase):