Fix loose comparisons, missing response codes, and session handling

- ticket.js: escape dependency_id with lt.escHtml() in data attribute
- assign_ticket.php: strict (int) cast for ticket_id (> 0 check), authorization
  comparisons, and add missing http_response_code(400) on invalid user ID
- TicketView.php: strict (int) cast for priority select, assigned_to select,
  and comment ownership check
- CommentModel.php: strict (int) cast for parent_comment_id thread comparison
- UserModel.php: strict (int) cast for is_admin check
- export_tickets.php: conditional session_start() to avoid double-start warning

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

views/TicketView.php

@@ -151,7 +151,7 @@ include __DIR__ . '/layout_header.php';
         <span class="lt-kv-value">
           <select id="prioritySelect" class="lt-select lt-select-sm editable-metadata" disabled aria-label="Priority">
             <?php foreach ([1=>'P1 - Critical',2=>'P2 - High',3=>'P3 - Medium',4=>'P4 - Low',5=>'P5 - Minimal'] as $v=>$l): ?>
-              <option value="<?= $v ?>" <?= $ticket['priority'] == $v ? 'selected' : '' ?>><?= $l ?></option>
+              <option value="<?= $v ?>" <?= (int)$ticket['priority'] === $v ? 'selected' : '' ?>><?= $l ?></option>
             <?php endforeach ?>
           </select>
         </span>
@@ -183,7 +183,7 @@ include __DIR__ . '/layout_header.php';
             <option value="">Unassigned</option>
             <?php foreach ($allUsers as $u): ?>
               <option value="<?= (int)$u['user_id'] ?>"
-                <?= ($ticket['assigned_to'] == $u['user_id']) ? 'selected' : '' ?>>
+                <?= ((int)$ticket['assigned_to'] === (int)$u['user_id']) ? 'selected' : '' ?>>
                 <?= htmlspecialchars($u['display_name'] ?? $u['username']) ?>
               </option>
             <?php endforeach ?>
@@ -361,7 +361,7 @@ include __DIR__ . '/layout_header.php';
           function renderComment(array $comment, ?int $currentUserId, bool $isAdmin, int $depth = 0): void {
               $displayName    = $comment['display_name_formatted'] ?? $comment['user_name'] ?? 'Unknown User';
               $commentId      = (int)$comment['comment_id'];
-              $isOwner        = ($comment['user_id'] == $currentUserId);
+              $isOwner        = ((int)$comment['user_id'] === (int)$currentUserId);
               $canModify      = $isOwner || $isAdmin;
               $markdownEnabled = (bool)($comment['markdown_enabled'] ?? false);
               $threadDepth    = (int)($comment['thread_depth'] ?? $depth);