v1.1.0

- In-app notifications: a bell in the top bar backed by Laravel's database
  notification channel, alongside existing e-mail notifications (same
  per-trigger toggle drives both; ticket links now correctly point into the
  recipient's own area instead of always linking to the client view).
- Drag-and-drop attachments on every upload form, plus inline image
  thumbnails in the message thread instead of a plain download link.
- Customer satisfaction (CSAT) rating: clients rate a closed ticket 1-5 stars
  with an optional comment; shown read-only to operators, surfaced as a KPI
  on the stats dashboard, and linked from the "ticket closed" e-mail.
- Saved queue views: operators can save/apply/delete named filter+sort+
  column presets in the ticket queue and mark one as their default.
- Full-text search (MySQL FULLTEXT, portable LIKE fallback) across ticket
  subject/body and reply message bodies, now also on the client's own ticket
  list.
- Stats CSV export for the currently filtered ticket set.
- Optional BookStack knowledge-base integration (off by default): suggests
  articles by category/subcategory while creating a ticket and in a separate
  sidebar for operators on an existing ticket (with a copy-link button).
  Configurable connection/SSL bypass/search-type filter, plus two
  independent per-shelf allow-lists so nothing is ever searched until an
  admin opts specific shelves in.
- Closed tickets no longer show in "Moje zgłoszenia"/"Nieprzypisane"/team
  queue tabs, only under "Zamknięte" (matching how "Otwarte" already worked).
- Wired up the Admin > About "Wersja" field to config('app.version')/VERSION
  in .env instead of a stale hardcoded string.
- Fixed: TicketService::setStatus() now checks a status's stage rather than
  the literal key 'closed' to decide whether to fire the "ticket closed"
  notification/stop the timer.
- Updated README/ARCHITECTURE/CHANGELOG/install/SECURITY docs and all three
  wiki/ role guides for the above; documented a root-vs-www-data file
  ownership gotcha in CLAUDE.md (running artisan commands via a plain
  `docker exec` can leave root-owned Blade cache files that later break
  recompilation for the www-data Apache process).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/app/Models/Ticket.php

@@ -8,11 +8,13 @@ use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\DB;
 
 #[Fillable([
     'number', 'customer_id', 'email', 'name', 'subcategory_id', 'subject', 'body',
     'status_key', 'priority_key', 'team_id', 'assignee_id', 'custom_fields', 'api_client_id',
     'sla_notified_at', 'time_spent_seconds', 'timer_started_at', 'created_at', 'updated_at',
+    'csat_rating', 'csat_comment', 'csat_rated_at',
 ])]
 class Ticket extends Model
 {
@@ -23,6 +25,8 @@ class Ticket extends Model
             'sla_notified_at' => 'datetime',
             'time_spent_seconds' => 'integer',
             'timer_started_at' => 'datetime',
+            'csat_rating' => 'integer',
+            'csat_rated_at' => 'datetime',
         ];
     }
 
@@ -129,6 +133,46 @@ class Ticket extends Model
             || $this->assignee_id === $user->id;
     }
 
+    /**
+     * Matches ticket number/subject/name/email plus subject/body and reply
+     * body text. Uses MySQL FULLTEXT (natural-language mode) on MySQL/MariaDB
+     * — matching the indexes added in the 2026_07_22_000141 migration — and
+     * falls back to plain LIKE on sqlite (used by the test suite), which has
+     * no FULLTEXT equivalent.
+     */
+    public function scopeSearch(Builder $query, string $term): Builder
+    {
+        $term = trim($term);
+
+        if ($term === '') {
+            return $query;
+        }
+
+        $mysql = DB::connection()->getDriverName() === 'mysql';
+        $like = '%'.$term.'%';
+
+        $messageTicketIds = DB::table('ticket_messages')
+            ->when(
+                $mysql,
+                fn ($q) => $q->whereFullText('body', $term),
+                fn ($q) => $q->where('body', 'like', $like),
+            )
+            ->pluck('ticket_id');
+
+        return $query->where(function (Builder $q) use ($term, $like, $mysql, $messageTicketIds) {
+            if ($mysql) {
+                $q->whereFullText(['subject', 'body'], $term);
+            } else {
+                $q->where('subject', 'like', $like)->orWhere('body', 'like', $like);
+            }
+
+            $q->orWhere('number', 'like', $like)
+                ->orWhere('name', 'like', $like)
+                ->orWhere('email', 'like', $like)
+                ->orWhereIn('id', $messageTicketIds);
+        });
+    }
+
     public function addHistory(string $text): TicketHistory
     {
         return $this->histories()->create(['text' => $text, 'created_at' => now()]);
@@ -166,6 +210,21 @@ class Ticket extends Model
         return Status::stageFor($this->status_key) === 'closed';
     }
 
+    public function hasCsatRating(): bool
+    {
+        return $this->csat_rating !== null;
+    }
+
+    /**
+     * A client can rate a ticket once it's closed, and only until they do —
+     * there's no "change your rating" flow, mirroring how e.g. edit-message
+     * doesn't apply once the underlying thing is done.
+     */
+    public function csatSubmittable(): bool
+    {
+        return $this->isClosed() && ! $this->hasCsatRating();
+    }
+
     /**
      * A resolution time of 0 minutes means "no SLA" for that priority, not
      * "due instantly" — such tickets never count down and never breach.