Use lt.api instead of raw fetch() in notification bell (#57)

layout_footer.php's loadNotifications() and "mark all read" handler
called fetch() directly instead of lt.api.*, violating the project's
own documented convention (README Dev Notes #20). api/bootstrap.php
rotates the CSRF token on every successful write and returns it in the
response's csrf_token field; lt.api.* reads that and updates
window.CSRF_TOKEN, but a raw fetch() never does — so after "mark all
read", the server had rotated its token but the client's cached one
was stale, causing the user's next write anywhere else in the app to
fail once with "Invalid CSRF token" before self-healing.

Replaced both fetch() calls with lt.api.get/post, which also drops the
now-redundant manual header/credentials boilerplate.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Lhz7pGMaoTfL5sdYS5XiKv

views/layout_footer.php

@@ -235,8 +235,7 @@
       }
 
       function loadNotifications() {
-        return fetch('/api/notifications.php', { credentials: 'same-origin' })
-          .then(function(r) { return r.json(); })
+        return lt.api.get('/api/notifications.php')
           .then(function(data) { renderNotifications(data); return true; })
           .catch(function() {
             list.innerHTML = '<div style="padding:0.75rem;font-size:0.75rem;color:var(--text-muted);text-align:center">Could not load</div>';
@@ -251,11 +250,7 @@
 
       if (clearBtn) {
         clearBtn.addEventListener('click', function() {
-          fetch('/api/notifications.php', {
-            method: 'POST', credentials: 'same-origin',
-            headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': window.CSRF_TOKEN || '' },
-            body: JSON.stringify({ action: 'mark_read' })
-          }).then(loadNotifications);
+          lt.api.post('/api/notifications.php', { action: 'mark_read' }).then(loadNotifications);
         });
       }