Fix comment avatar, activity log labels, and ticket update permissions

- add_comment.php: include user_id in response for avatar rendering
- ticket.js: add buildCommentElement() helper that matches server-rendered
  comment structure (avatar, edit/delete buttons, textarea); use it in
  addComment() and submitReply() so new comments show the avatar immediately
- AuditLogModel: logCommentCreate uses action_type='comment' not 'create'
- TicketView: formatAction handles entity_type='comment' with action_type='create'
  for existing DB records; prevents "created this ticket" showing for comments
- update_ticket.php: remove owner/assignee restriction so any authenticated
  team member can update ticket status and fields

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

views/TicketView.php

@@ -37,7 +37,9 @@ function getEventIcon(string $actionType): string {
 function formatAction(array $event): string {
     $det = $event['details'] ?? [];
     switch ($event['action_type']) {
-        case 'create':        return 'created this ticket';
+        case 'create':
+            if (($event['entity_type'] ?? '') === 'comment') return 'posted a comment';
+            return 'created this ticket';
         case 'comment':       return 'posted a comment';
         case 'view':          return 'viewed this ticket';
         case 'attachment':    return 'uploaded a file';