Ticket-provider auth failures should surface in UI, not just logs

[jonwiggins]

Closes #438

What changed

Ticket-provider sync errors (e.g. GitHub 401 "Bad credentials") were only visible in server logs, creating noise without any user-facing signal. This PR:

• Persists sync errors per provider: Adds last_error, last_error_at, and consecutive_failures columns to the ticket_providers table. On each sync failure the error message and failure count are recorded; on success they are cleared.
• Auto-disables after 5 consecutive failures: Providers that keep failing are automatically disabled to stop log spam. A warning is logged once when this happens.
• Rate-limits error logging: Repeated failures with the same error message are downgraded to debug level instead of error, cutting log noise significantly.
• Surfaces errors in the UI: The Settings > Ticket Providers section now shows the error message, timestamp, failure count, and a "Re-enable" button when a provider has errors or is disabled.
• Adds PATCH /api/tickets/providers/:id/re-enable: Clears all error state and re-enables the provider — intended for use after the user refreshes their token.

How to test

1. Configure a ticket provider (e.g. GitHub) with an invalid token
2. Trigger a sync (click "Sync Now") or wait for the periodic sync
3. Go to Settings > Ticket Integration — the provider should show a red error box with the failure message, "Re-enable" button, and failure count
4. After 5 consecutive failures the provider should be auto-disabled (status dot turns grey, "Disabled" label appears)
5. Fix the token (delete + re-add, or re-enter credentials), then click "Re-enable" — error state clears and syncing resumes
6. Verify that repeated sync failures only log at debug level (not error) after the first occurrence

Tests: 4 new test cases covering error persistence, success reset, auto-disable, and log downgrading. All 1934 tests pass. Typecheck and web build clean.