Add AI support copilot Phase 2: gated artisan changes over SSH

[bernardhanna]

Lets the support copilot run server maintenance commands through the same dry-run -> APPROVE -> execute -> report pipeline as other write actions. Disabled by default (SUPPORT_AI_ARTISAN_ENABLED=false).

• ArtisanActionRegistry: allowlist of permitted commands with per-argument type validation (email/token/name). Seeded with support:user-audit, support:event-audit, support:user-restore, support:user-update-profile.
• ArtisanCommandRunner: builds/validates a plan, dry-runs (write commands get --dry-run; read-only run as-is; raw is never auto-simulated), and executes via the Process array form so values can't be shell-interpreted. Re-validates at execution time rather than trusting the stored approval payload.
• Guarded raw fallback (SUPPORT_AI_ARTISAN_ALLOW_RAW): AI-proposed artisan commands are rejected on shell metacharacters and a destructive deny-list (migrate:fresh, db:wipe, tinker, down, ...), treated as writes, APPROVE-gated.
• Triage gains the artisan_command case type (only offered when enabled) plus artisan_command_name/artisan_args/artisan_raw_command fields.
• Wired into diagnostics (dry-run preview), the approval email (exact command + preview), execute job, and completion email (command + output). setup-check now reports artisan status; allowed_write_actions includes artisan_command.
• Tests for registry validation and the raw-command guard; docs updated.