Migrate all raw fetch() calls to lt.api, fix CSS fallback values

- Replace all 23 raw fetch() calls in dashboard.js and ticket.js with
  lt.api.get/post/delete — removes manual CSRF header injection,
  manual JSON parsing boilerplate, and response.ok checks throughout
- dashboard.js: 10 calls (inline save x2, template GET, 5x bulk ops,
  quick-status, quick-assign)
- ticket.js: 13 calls (main save, add/update/delete comment x3, reply,
  assign, metadata update, status change, deps GET/POST/DELETE,
  attachments GET, delete attachment)
- Remove stale csrf_token from deleteAttachment body (lt.api sends the
  X-CSRF-Token header automatically)
- Fix CSS variable fallbacks in ticket.css: replace
  var(--text-primary, #f7fafc) and var(--bg-secondary, #1a202c)
  with plain var(--text-primary) and var(--bg-secondary)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

assets/css/ticket.css

@@ -1410,16 +1410,16 @@ body.dark-mode .status-select option {
 
 /* Dark mode for Activity tab and general improvements */
 body.dark-mode .tab-content {
-    color: var(--text-primary, #f7fafc);
+    color: var(--text-primary);
 }
 
 body.dark-mode #activity-tab {
-    background: var(--bg-secondary, #1a202c);
-    color: var(--text-primary, #f7fafc);
+    background: var(--bg-secondary);
+    color: var(--text-primary);
 }
 
 body.dark-mode #activity-tab p {
-    color: var(--text-primary, #f7fafc);
+    color: var(--text-primary);
 }
 
 /* Comprehensive Dark Mode Fix - terminal CSS variables apply throughout */