feat(iios): generic opaque metadata + manual ticket assign (glue prereqs)

Generic kernel primitives so app backends (e.g. a CRM support glue) can link
their domain to interactions WITHOUT the kernel learning any app vocabulary:

- thread: accept an opaque `metadata` bag on create (merged with membership),
  echo it in listThreads, and filter listThreads by `?metadata[key]=value`
  (equality on the opaque bag — the kernel never interprets the keys).
- support: accept opaque `metadata` on createTicket/escalate (thread bag
  inherited); add SupportService.assignTo — a policy-gated manual assignment
  of a ticket to a target actor (POST /v1/support/tickets/:id/assignee).
- SDK @insignia/iios-kernel-client 0.1.2: createThread(metadata),
  listThreads({metadata}) filter, createTicket(metadata), escalate(metadata),
  assignTicket; ThreadSummary/Ticket expose the opaque bag.

Generic-safety gate holds: no crm/customer/lead in kernel code (opaque values
only). Tests: +2 (metadata create/filter, ticket metadata + assignTo); 31 pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-service/src/support/support.controller.ts

@@ -5,6 +5,7 @@ import { AssignmentService } from './assignment.service';
 import { SessionVerifier } from '../platform/session.verifier';
 import type { MessagePrincipal } from '../identity/actor.resolver';
 import {
+  AssignTicketDto,
   AvailabilityDto,
   CallbackDto,
   CreateQueueDto,
@@ -32,7 +33,7 @@ export class SupportController {
 
   @Post('escalate')
   async escalate(@Body() body: EscalateDto, @Headers('authorization') auth?: string) {
-    return this.support.escalate(body.threadId, this.principal(auth), body.subject);
+    return this.support.escalate(body.threadId, this.principal(auth), body.subject, body.metadata);
   }
 
   @Get('tickets')
@@ -45,6 +46,12 @@ export class SupportController {
     return this.support.transition(id, this.principal(auth), body.state as IiosTicketState, body.reason);
   }
 
+  /** Manually assign a ticket to a specific actor (by userId) — generic assignment override. */
+  @Post('tickets/:id/assignee')
+  async assign(@Param('id') id: string, @Body() body: AssignTicketDto, @Headers('authorization') auth?: string) {
+    return this.support.assignTo(id, this.principal(auth), body.userId);
+  }
+
   @Post('callbacks')
   async callback(
     @Body() body: CallbackDto,