Fix bugs found in second multi-agent review

XSS / security:
- markdown.js: sanitize footnote labels to a safe slug before using them in
  id/href attributes. Labels are captured before the HTML-escape pass, so a
  label like x"><img onerror=...> broke out → stored XSS (the earlier quote-
  escape fix didn't cover this path). Verified neutralized.
- RateLimitMiddleware: only trust X-Forwarded-For / X-Real-IP when REMOTE_ADDR
  is a configured trusted proxy, and use the rightmost (proxy-appended) entry.
  Previously any client could rotate XFF to escape the per-IP rate limit.
- .env.example: document TRUSTED_PROXIES so fresh deploys aren't fail-open on
  the Authelia forward-auth spoofing protection.

Correctness:
- notifications.php: my previous assigned-to LIKE fix anchored only on '}', so
  BULK assignments (logged {"assigned_to":N,"bulk_operation_id":..}) produced
  no "assigned to you" notification — now matches both '}' and ',' delimiters.
- notifications.php: implement the documented @mention notifications (query
  action_type='mention' rows for the current user); they were never delivered.
- NotificationHelper::notifyWatchers: guard unchecked prepare() so a missing
  ticket_watchers table can't fatal the request after its DB write committed.
- AuditLogModel::getTicketTimeline: JSON_UNQUOTE the extracted ticket_id so
  comment events actually match (string vs JSON-number comparison never did).
- AuditLogModel/audit_log.php: CSV export no longer silently truncates to the
  1000-row UI cap; uses a dedicated higher export limit.
- DashboardView: quick-preview drawer read .ticket-link from the title cell
  (which has none), so the title was always blank — use the cell text.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

models/AuditLogModel.php

@@ -10,6 +10,9 @@ class AuditLogModel
     /** @var int Maximum allowed limit for pagination */
     private const MAX_LIMIT = 1000;
 
+    /** @var int Maximum rows for a CSV/forensic export (higher than the UI cap) */
+    private const EXPORT_LIMIT = 100000;
+
     /** @var int Default limit for pagination */
     private const DEFAULT_LIMIT = 100;
 
@@ -36,12 +39,12 @@ class AuditLogModel
      * @param int $limit Requested limit
      * @return int Validated limit
      */
-    private function validateLimit(int $limit): int
+    private function validateLimit(int $limit, int $max = self::MAX_LIMIT): int
     {
         if ($limit < 1) {
             return self::DEFAULT_LIMIT;
         }
-        return min($limit, self::MAX_LIMIT);
+        return min($limit, $max);
     }
 
     /**
@@ -534,7 +537,7 @@ class AuditLogModel
              FROM audit_log al
              LEFT JOIN users u ON al.user_id = u.user_id
              WHERE (al.entity_type = 'ticket' AND al.entity_id = ?)
-                OR (al.entity_type = 'comment' AND JSON_EXTRACT(al.details, '$.ticket_id') = ?)
+                OR (al.entity_type = 'comment' AND JSON_UNQUOTE(JSON_EXTRACT(al.details, '$.ticket_id')) = ?)
              ORDER BY al.created_at DESC"
         );
         $stmt->bind_param("ss", $ticketId, $ticketId);
@@ -561,10 +564,11 @@ class AuditLogModel
      * @param int $offset Offset for pagination
      * @return array Array containing logs and total count
      */
-    public function getFilteredLogs($filters = [], $limit = 50, $offset = 0)
+    public function getFilteredLogs($filters = [], $limit = 50, $offset = 0, $forExport = false)
     {
-        // Validate pagination parameters
-        $limit = $this->validateLimit((int)$limit);
+        // Validate pagination parameters. Exports allow a much higher cap so a
+        // forensic/compliance CSV isn't silently truncated to the UI page limit.
+        $limit = $this->validateLimit((int)$limit, $forExport ? self::EXPORT_LIMIT : self::MAX_LIMIT);
         $offset = $this->validateOffset((int)$offset);
 
         $whereConditions = [];