Fix bugs found in second multi-agent review

XSS / security:
- markdown.js: sanitize footnote labels to a safe slug before using them in
  id/href attributes. Labels are captured before the HTML-escape pass, so a
  label like x"><img onerror=...> broke out → stored XSS (the earlier quote-
  escape fix didn't cover this path). Verified neutralized.
- RateLimitMiddleware: only trust X-Forwarded-For / X-Real-IP when REMOTE_ADDR
  is a configured trusted proxy, and use the rightmost (proxy-appended) entry.
  Previously any client could rotate XFF to escape the per-IP rate limit.
- .env.example: document TRUSTED_PROXIES so fresh deploys aren't fail-open on
  the Authelia forward-auth spoofing protection.

Correctness:
- notifications.php: my previous assigned-to LIKE fix anchored only on '}', so
  BULK assignments (logged {"assigned_to":N,"bulk_operation_id":..}) produced
  no "assigned to you" notification — now matches both '}' and ',' delimiters.
- notifications.php: implement the documented @mention notifications (query
  action_type='mention' rows for the current user); they were never delivered.
- NotificationHelper::notifyWatchers: guard unchecked prepare() so a missing
  ticket_watchers table can't fatal the request after its DB write committed.
- AuditLogModel::getTicketTimeline: JSON_UNQUOTE the extracted ticket_id so
  comment events actually match (string vs JSON-number comparison never did).
- AuditLogModel/audit_log.php: CSV export no longer silently truncates to the
  1000-row UI cap; uses a dedicated higher export limit.
- DashboardView: quick-preview drawer read .ticket-link from the title cell
  (which has none), so the title was always blank — use the cell text.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

assets/js/markdown.js

@@ -6,6 +6,13 @@
 function parseMarkdown(markdown) {
     if (!markdown) return '';
 
+    // Footnote labels are captured before the HTML-escape pass, so they must be
+    // sanitized to a safe slug before being interpolated into id/href attributes
+    // (otherwise a label like `x"><img onerror=...>` breaks out → stored XSS).
+    var fnSlug = function (label) {
+        return String(label).replace(/[^a-zA-Z0-9_-]/g, '-');
+    };
+
     // Footnotes — collect definitions and mark references with placeholders
     // (must happen before HTML escaping so <sup> tags don't get escaped)
     const footnotes = {};
@@ -146,7 +153,7 @@ function parseMarkdown(markdown) {
     // Restore footnote reference placeholders
     fnRefs.forEach(function(ref, i) {
         html = html.replace('%%FNREF' + i + '%%',
-            '<sup class="fn-ref"><a href="#fn-' + ref.label + '" id="fnref-' + ref.label + '">[' + ref.n + ']</a></sup>');
+            '<sup class="fn-ref"><a href="#fn-' + fnSlug(ref.label) + '" id="fnref-' + fnSlug(ref.label) + '">[' + ref.n + ']</a></sup>');
     });
 
     // Wrap in paragraph if not already wrapped
@@ -158,9 +165,9 @@ function parseMarkdown(markdown) {
     if (footnoteOrder.length) {
         html += '<hr class="fn-hr"><ol class="fn-list">';
         footnoteOrder.forEach(function(label, i) {
-            html += '<li id="fn-' + label + '" class="fn-item">' +
+            html += '<li id="fn-' + fnSlug(label) + '" class="fn-item">' +
                 parseMarkdown(footnotes[label]).replace(/<\/?p>/g, '') +
-                ' <a href="#fnref-' + label + '" class="fn-back">&#x21A9;</a></li>';
+                ' <a href="#fnref-' + fnSlug(label) + '" class="fn-back">&#x21A9;</a></li>';
         });
         html += '</ol>';
     }