Add ticket CLI commands for SOC ticket management

[maximelb]

Summary

• Adds limacharlie ticket command group integrating the ext-ticketing system with the CLI
• Full ticket lifecycle management: list, get, update, add-note, bulk-update, merge
• Investigation tracking: entities (IOCs), telemetry references, forensic artifacts, detection linking
• SOC reporting and dashboard metrics
• Org-level ticketing configuration management
• New SDK module (limacharlie/sdk/ticketing.py) wrapping the ext-ticketing REST API
• New CLI module (limacharlie/commands/ticket.py) with 25+ subcommands following existing CLI patterns
• Added ticketing discovery profile and updated threat_response profile

Command overview

limacharlie ticket list [--status ...] [--severity ...] [--search ...]
limacharlie ticket get --id <ID>
limacharlie ticket update --id <ID> [--status ...] [--assignee ...]
limacharlie ticket add-note --id <ID> --content "..."
limacharlie ticket bulk-update --ids <ID1>,<ID2> --status closed
limacharlie ticket merge --target <ID> --sources <ID1>,<ID2>

limacharlie ticket entity add --ticket <ID> --type ip --value "10.0.0.1"
limacharlie ticket entity search --type domain --value "evil.com"
limacharlie ticket telemetry add --ticket <ID> --atom <ATOM> --sid <SID>
limacharlie ticket artifact add --ticket <ID> --type pcap
limacharlie ticket detection add --ticket <ID> --detection-id <DET_ID>

limacharlie ticket report --from <RFC3339> --to <RFC3339>
limacharlie ticket dashboard
limacharlie ticket config-get / config-set
limacharlie ticket assignees

Test plan

• Module loads correctly (auto-discovery picks up ticket.py)
• All 803 existing unit tests pass
• CLI help renders correctly for all commands and nested groups
• Manual testing against live ext-ticketing instance
• Verify auth flow works with LC JWT against ticketing API

🤖 Generated with Claude Code