fix(ticket): route attachment upload through UserController singleton

The static-array callable pointed at an instance method, which PHP 8
rejects as non-callable, so WP answered every upload with rest_invalid_handler.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/widget-system/ticket-permission-contract.test.cjs

@@ -54,8 +54,10 @@ test('attachment upload permission is gated on the ticket attachment switch', ()
 
   assert.match(body, /TicketSettings::enabled\(\)/);
   assert.match(body, /TicketSettings::attachment_enabled\(\)/);
-  // 复用评论图片上传 handler，不自建上传链路。
-  assert.match(rest, /callback' => \[\\AKSRT\\Admin\\UserController::class, 'rest_upload_comment_image'\]/);
+  // 复用评论图片上传 handler，不自建上传链路；实例方法必须经单例调用（静态数组 callable 在 PHP 8 不可调用）。
+  assert.match(rest, /'callback' => \[\$this, 'upload_attachment'\]/);
+  assert.match(rest, /UserController::get_instance\(\)->rest_upload_comment_image\(\$request\)/);
+  assert.doesNotMatch(rest, /UserController::class, 'rest_upload_comment_image'/);
   // 上传路由挂在 /ticket/upload-attachment（与 /report/upload-image 同构）。
   assert.match(rest, /'\/ticket\/upload-attachment'/);
 });