Fix CSRF token drift in add_comment and update_ticket endpoints

api/add_comment.php

@@ -52,9 +52,15 @@ try {
         if (!CsrfMiddleware::validateToken($csrfToken)) {
             http_response_code(403);
             header('Content-Type: application/json');
-            echo json_encode(['success' => false, 'error' => 'Invalid CSRF token']);
+            echo json_encode([
+                'success' => false, 
+                'error' => 'Invalid CSRF token',
+                'csrf_token' => CsrfMiddleware::getToken()
+            ]);
             exit;
         }
+        // Rotate token after successful validation
+        $newCsrfToken = CsrfMiddleware::rotateToken();
     }
 
     $currentUser = $_SESSION['user'];
@@ -208,6 +214,9 @@ try {
     if ($result['success']) {
         $result['user_name'] = $currentUser['display_name'] ?? $currentUser['username'];
         $result['user_id']   = $userId;
+        if (isset($newCsrfToken)) {
+            $result['csrf_token'] = $newCsrfToken;
+        }
     }
 
     // Discard any unexpected output