Scenario: SLA Breach Dashboard by Team

Write SQL to count open breached tickets by team from `tickets(team_id, due_at, resolved_at, status)` where breach means unresolved and due_at < now.