Fix API security: dependency/visibility leaks, authz, CSRF, comment spoofing

- ticket_dependencies.php: pass current user id/groups/is_admin into the
  visibility-filtered DependencyModel methods; drop (int) casts that
  stripped leading zeros from varchar ticket_ids
- update_ticket.php: authorize visibility changes (admin or creator only);
  enforce requires_comment transitions server-side (400 + requires_comment
  flag so the client can prompt-and-retry); return proper 401/400/403
- add_comment.php: take commenter name from the session not the client
  (anti-spoofing); validate parent_comment_id belongs to the ticket;
  reject empty comments; pass ticket visibility to notifications so
  non-public comment bodies aren't leaked
- add_comment/update_comment/bulk_operation: validate CSRF for all
  state-changing methods, not just POST
- bootstrap.php: return the current CSRF token on rejection and never
  rotate it on a rejected request, so a desynced client can auto-recover
- correct auth->401 and validation->400 status codes across these endpoints

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

api/update_comment.php

@@ -27,12 +27,16 @@ try {
         session_start();
     }
     if (!isset($_SESSION['user']) || !isset($_SESSION['user']['user_id'])) {
-        throw new Exception("Authentication required");
+        ob_end_clean();
+        http_response_code(401);
+        header('Content-Type: application/json');
+        echo json_encode(['success' => false, 'error' => 'Authentication required']);
+        exit;
     }
 
-    // CSRF Protection
+    // CSRF Protection for all state-changing methods (any non-GET/HEAD request)
     require_once dirname(__DIR__) . '/middleware/CsrfMiddleware.php';
-    if ($_SERVER['REQUEST_METHOD'] === 'POST' || $_SERVER['REQUEST_METHOD'] === 'PUT') {
+    if (!in_array($_SERVER['REQUEST_METHOD'], ['GET', 'HEAD'], true)) {
         $csrfToken = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
         if (!CsrfMiddleware::validateToken($csrfToken)) {
             http_response_code(403);
@@ -53,7 +57,11 @@ try {
     $data = json_decode(file_get_contents('php://input'), true);
 
     if (!$data || !isset($data['comment_id']) || !isset($data['comment_text'])) {
-        throw new Exception("Missing required fields: comment_id, comment_text");
+        ob_end_clean();
+        http_response_code(400);
+        header('Content-Type: application/json');
+        echo json_encode(['success' => false, 'error' => 'Missing required fields: comment_id, comment_text']);
+        exit;
     }
 
     $commentId = (int)$data['comment_id'];
@@ -61,7 +69,11 @@ try {
     $markdownEnabled = isset($data['markdown_enabled']) && $data['markdown_enabled'];
 
     if (empty($commentText)) {
-        throw new Exception("Comment text cannot be empty");
+        ob_end_clean();
+        http_response_code(400);
+        header('Content-Type: application/json');
+        echo json_encode(['success' => false, 'error' => 'Comment text cannot be empty']);
+        exit;
     }
 
     // Initialize models