Integrate web_template design system and fix security/quality issues

Security fixes:
- Add HTTP method validation to delete_comment.php (block CSRF via GET)
- Remove $_GET fallback in comment deletion (was CSRF bypass vector)
- Guard session_start() with session_status() check across API files
- Escape json_encode() data attributes with htmlspecialchars in views
- Escape inline APP_TIMEZONE config values in DashboardView/TicketView
- Validate timezone param against DateTimeZone::listIdentifiers() in index.php
- Remove Database::escape() (was using real_escape_string, not safe)
- Fix AttachmentModel hardcoded connection; inject via constructor

Backend fixes:
- Fix CommentModel bind_param type for ticket_id (s→i)
- Fix buildCommentThread orphan parent guard
- Fix StatsModel JOIN→LEFT JOIN so unassigned tickets aren't excluded
- Add ticket ID validation in BulkOperationsModel before implode()
- Add duplicate key retry in TicketModel::createTicket() for race conditions
- Wrap SavedFiltersModel default filter changes in transactions
- Add null result guards in WorkflowModel query methods

Frontend JS:
- Rewrite toast.js as lt.toast shim (base.js dependency)
- Delegate escapeHtml() to lt.escHtml()
- Rewrite keyboard-shortcuts.js using lt.keys.on()
- Migrate settings.js to lt.api.* and lt.modal.open/close()
- Migrate advanced-search.js to lt.api.* and lt.modal.open/close()
- Migrate dashboard.js fetch calls to lt.api.*; update all dynamic
  modals (bulk ops, quick actions, confirm/input) to lt-modal structure
- Migrate ticket.js fetchMentionUsers to lt.api.get()
- Remove console.log/error/warn calls from JS files

Views:
- Add /web_template/base.css and base.js to all 10 view files
- Call lt.keys.initDefaults() in DashboardView, TicketView, admin views
- Migrate all modal HTML from settings-modal/settings-content to
  lt-modal-overlay/lt-modal/lt-modal-header/lt-modal-body/lt-modal-footer
- Replace style="display:none" with aria-hidden="true" on all modals
- Replace modal open/close style.display with lt.modal.open/close()
- Update modal buttons to lt-btn lt-btn-primary/lt-btn-ghost classes
- Remove manual ESC keydown handlers (replaced by lt.keys.initDefaults)
- Fix unescaped timezone values in TicketView inline script

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

models/AttachmentModel.php

@@ -3,22 +3,11 @@
  * AttachmentModel - Handles ticket file attachments
  */
 
-require_once __DIR__ . '/../config/config.php';
-
 class AttachmentModel {
     private $conn;
 
-    public function __construct() {
-        $this->conn = new mysqli(
-            $GLOBALS['config']['DB_HOST'],
-            $GLOBALS['config']['DB_USER'],
-            $GLOBALS['config']['DB_PASS'],
-            $GLOBALS['config']['DB_NAME']
-        );
-
-        if ($this->conn->connect_error) {
-            throw new Exception('Database connection failed: ' . $this->conn->connect_error);
-        }
+    public function __construct($conn) {
+        $this->conn = $conn;
     }
 
     /**
@@ -204,9 +193,4 @@ class AttachmentModel {
         return in_array($mimeType, $allowedTypes);
     }
 
-    public function __destruct() {
-        if ($this->conn) {
-            $this->conn->close();
-        }
-    }
 }

models/BulkOperationsModel.php

@@ -19,6 +19,14 @@ class BulkOperationsModel {
      * @return int|false Operation ID or false on failure
      */
     public function createBulkOperation($type, $ticketIds, $userId, $parameters = null) {
+        // Validate ticket IDs to prevent injection via implode
+        $ticketIds = array_values(array_filter(
+            array_map('strval', $ticketIds),
+            fn($id) => preg_match('/^[0-9]+$/', $id)
+        ));
+        if (empty($ticketIds)) {
+            return false;
+        }
         $ticketIdsStr = implode(',', $ticketIds);
         $totalTickets = count($ticketIds);
         $parametersJson = $parameters ? json_encode($parameters) : null;

models/CommentModel.php

@@ -71,7 +71,7 @@ class CommentModel {
         }
 
         $stmt = $this->conn->prepare($sql);
-        $stmt->bind_param("s", $ticketId);
+        $stmt->bind_param("i", $ticketId);
         $stmt->execute();
         $result = $stmt->get_result();
 
@@ -126,7 +126,8 @@ class CommentModel {
     private function buildCommentThread($comment, &$allComments) {
         $comment['replies'] = [];
         foreach ($allComments as $c) {
-            if ($c['parent_comment_id'] == $comment['comment_id']) {
+            if ($c['parent_comment_id'] == $comment['comment_id']
+                && isset($allComments[$c['comment_id']])) {
                 $comment['replies'][] = $this->buildCommentThread($c, $allComments);
             }
         }

models/SavedFiltersModel.php

@@ -54,29 +54,36 @@ class SavedFiltersModel {
      * Save a new filter
      */
     public function saveFilter($userId, $filterName, $filterCriteria, $isDefault = false) {
-        // If this is set as default, unset all other defaults for this user
-        if ($isDefault) {
-            $this->clearDefaultFilters($userId);
+        $this->conn->begin_transaction();
+        try {
+            // If this is set as default, unset all other defaults for this user
+            if ($isDefault) {
+                $this->clearDefaultFilters($userId);
+            }
+
+            $sql = "INSERT INTO saved_filters (user_id, filter_name, filter_criteria, is_default)
+                    VALUES (?, ?, ?, ?)
+                    ON DUPLICATE KEY UPDATE
+                        filter_criteria = VALUES(filter_criteria),
+                        is_default = VALUES(is_default),
+                        updated_at = CURRENT_TIMESTAMP";
+
+            $stmt = $this->conn->prepare($sql);
+            $criteriaJson = json_encode($filterCriteria);
+            $stmt->bind_param("issi", $userId, $filterName, $criteriaJson, $isDefault);
+
+            if ($stmt->execute()) {
+                $filterId = $stmt->insert_id ?: $this->getFilterIdByName($userId, $filterName);
+                $this->conn->commit();
+                return ['success' => true, 'filter_id' => $filterId];
+            }
+            $error = $this->conn->error;
+            $this->conn->rollback();
+            return ['success' => false, 'error' => $error];
+        } catch (Exception $e) {
+            $this->conn->rollback();
+            return ['success' => false, 'error' => $e->getMessage()];
         }
-
-        $sql = "INSERT INTO saved_filters (user_id, filter_name, filter_criteria, is_default)
-                VALUES (?, ?, ?, ?)
-                ON DUPLICATE KEY UPDATE
-                    filter_criteria = VALUES(filter_criteria),
-                    is_default = VALUES(is_default),
-                    updated_at = CURRENT_TIMESTAMP";
-
-        $stmt = $this->conn->prepare($sql);
-        $criteriaJson = json_encode($filterCriteria);
-        $stmt->bind_param("issi", $userId, $filterName, $criteriaJson, $isDefault);
-
-        if ($stmt->execute()) {
-            return [
-                'success' => true,
-                'filter_id' => $stmt->insert_id ?: $this->getFilterIdByName($userId, $filterName)
-            ];
-        }
-        return ['success' => false, 'error' => $this->conn->error];
     }
 
     /**
@@ -126,18 +133,25 @@ class SavedFiltersModel {
      * Set a filter as default
      */
     public function setDefaultFilter($filterId, $userId) {
-        // First, clear all defaults
-        $this->clearDefaultFilters($userId);
+        $this->conn->begin_transaction();
+        try {
+            $this->clearDefaultFilters($userId);
 
-        // Then set this one as default
-        $sql = "UPDATE saved_filters SET is_default = 1 WHERE filter_id = ? AND user_id = ?";
-        $stmt = $this->conn->prepare($sql);
-        $stmt->bind_param("ii", $filterId, $userId);
+            $sql = "UPDATE saved_filters SET is_default = 1 WHERE filter_id = ? AND user_id = ?";
+            $stmt = $this->conn->prepare($sql);
+            $stmt->bind_param("ii", $filterId, $userId);
 
-        if ($stmt->execute()) {
-            return ['success' => true];
+            if ($stmt->execute()) {
+                $this->conn->commit();
+                return ['success' => true];
+            }
+            $error = $this->conn->error;
+            $this->conn->rollback();
+            return ['success' => false, 'error' => $error];
+        } catch (Exception $e) {
+            $this->conn->rollback();
+            return ['success' => false, 'error' => $e->getMessage()];
         }
-        return ['success' => false, 'error' => $this->conn->error];
     }
 
     /**

models/StatsModel.php

@@ -134,7 +134,7 @@ class StatsModel {
                     u.username,
                     COUNT(t.ticket_id) as ticket_count
                 FROM tickets t
-                JOIN users u ON t.assigned_to = u.user_id
+                LEFT JOIN users u ON t.assigned_to = u.user_id
                 WHERE t.status != 'Closed'
                 GROUP BY t.assigned_to
                 ORDER BY ticket_count DESC

models/TicketModel.php

@@ -422,13 +422,41 @@ class TicketModel {
                 'ticket_id' => $ticket_id
             ];
         } else {
+            // Handle duplicate key (errno 1062) caused by race condition between
+            // the uniqueness SELECT above and this INSERT — regenerate and retry once
+            if ($this->conn->errno === 1062) {
+                $stmt->close();
+                try {
+                    $ticket_id = sprintf('%09d', random_int(100000000, 999999999));
+                } catch (Exception $e) {
+                    $ticket_id = sprintf('%09d', mt_rand(100000000, 999999999));
+                }
+                $stmt = $this->conn->prepare($sql);
+                $stmt->bind_param(
+                    "sssssssiiss",
+                    $ticket_id,
+                    $ticketData['title'],
+                    $ticketData['description'],
+                    $status,
+                    $priority,
+                    $category,
+                    $type,
+                    $createdBy,
+                    $assignedTo,
+                    $visibility,
+                    $visibilityGroups
+                );
+                if ($stmt->execute()) {
+                    return ['success' => true, 'ticket_id' => $ticket_id];
+                }
+            }
             return [
                 'success' => false,
                 'error' => $this->conn->error
             ];
         }
     }
-    
+
     public function addComment(int $ticketId, array $commentData): array {
         $sql = "INSERT INTO ticket_comments (ticket_id, user_name, comment_text, markdown_enabled) 
                 VALUES (?, ?, ?, ?)";

models/WorkflowModel.php

@@ -27,6 +27,10 @@ class WorkflowModel {
                     WHERE is_active = TRUE";
             $result = $this->conn->query($sql);
 
+            if (!$result) {
+                return [];
+            }
+
             $transitions = [];
             while ($row = $result->fetch_assoc()) {
                 $from = $row['from_status'];
@@ -102,6 +106,10 @@ class WorkflowModel {
                     ORDER BY status";
             $result = $this->conn->query($sql);
 
+            if (!$result) {
+                return [];
+            }
+
             $statuses = [];
             while ($row = $result->fetch_assoc()) {
                 $statuses[] = $row['status'];