Address remaining review items: Synapse caching, cycle detection, cache/ratelimit/kanban

- SynapseHelper: memoize username->Matrix-ID lookups per-request (incl. negative
  results) and add an overall time budget to resolveUsernames() plus a 2s connect
  timeout, so notifying N watchers with a slow/unreachable Synapse can't stall the
  request for N x 5s. (Chosen over async/queue per maintainer.)
- DependencyModel: fix cycle detection treating 'blocks' and 'blocked_by' as the
  same edge direction. They are inverse relationships (single row each, no mirror
  row), so the traversal now walks a unified precedence graph (blocks: ticket->
  depends_on; blocked_by: depends_on->ticket) and wouldCreateCycle normalizes the
  new edge's direction. Prevents both false-positive and missed cycles.
- CacheHelper: anchor prefix-delete to exact key boundaries (bare prefix or
  prefix + '_' + md5) so delete('workflow') can't wipe a 'workflow_rules' cache.
- RateLimitMiddleware: hold an exclusive flock across the per-IP counter's
  read-modify-write so concurrent requests can't both read N and write N+1
  (undercounting past the limit). Fails open if the file can't be locked.
- dashboard.js: kanban status update now uses lt.api.post (per no-raw-fetch
  convention) and reverts the card AND the optimistic column counts on failure
  (the old raw-fetch catch left the card moved without reverting).
- BulkOperationsModel: document that bulk_status/bulk_close intentionally bypass
  workflow transition validation (admin override, by design).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

assets/js/dashboard.js

@@ -1219,29 +1219,30 @@ function populateKanbanCards() {
             if (dec) dec.textContent = '(' + Math.max(0, (parseInt(dec.textContent.replace(/\D/g,''),10)||1) - 1) + ')';
             if (inc) inc.textContent = '(' + ((parseInt(inc.textContent.replace(/\D/g,''),10)||0) + 1) + ')';
 
-            // POST status update
-            fetch('/api/update_ticket.php', {
-                method: 'POST',
-                credentials: 'same-origin',
-                headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': window.CSRF_TOKEN || '' },
-                body: JSON.stringify({ ticket_id: String(ticketId), status: newStatus })
-            })
-            .then(r => r.json())
-            .then(data => {
-                if (data.success) {
-                    lt.toast.success('Ticket #' + ticketId + ' → ' + newStatus, 2500);
-                    movedCard.dataset.status = newStatus;
-                } else {
-                    lt.toast.error('Status update failed: ' + (data.error || 'Unknown error'));
-                    // Revert: put card back in original column
-                    const origCol = document.getElementById(Object.keys(colStatusMap).find(k => colStatusMap[k] === oldStatus));
-                    if (origCol) origCol.appendChild(movedCard);
-                    movedCard.dataset.status = oldStatus;
-                }
-            })
-            .catch(() => {
-                lt.toast.error('Network error — status not saved');
-            });
+            // Revert the card to its original column and undo the optimistic counts.
+            const revert = function () {
+                const origCol = document.getElementById(Object.keys(colStatusMap).find(k => colStatusMap[k] === oldStatus));
+                if (origCol) origCol.appendChild(movedCard);
+                movedCard.dataset.status = oldStatus;
+                if (dec) dec.textContent = '(' + ((parseInt(dec.textContent.replace(/\D/g, ''), 10) || 0) + 1) + ')';
+                if (inc) inc.textContent = '(' + Math.max(0, (parseInt(inc.textContent.replace(/\D/g, ''), 10) || 1) - 1) + ')';
+            };
+
+            // POST status update via the shared wrapper (adds CSRF + JSON, throws on non-2xx)
+            lt.api.post('/api/update_ticket.php', { ticket_id: String(ticketId), status: newStatus })
+                .then(function (data) {
+                    if (data && data.success) {
+                        lt.toast.success('Ticket #' + ticketId + ' → ' + newStatus, 2500);
+                        movedCard.dataset.status = newStatus;
+                    } else {
+                        lt.toast.error('Status update failed: ' + ((data && data.error) || 'Unknown error'));
+                        revert();
+                    }
+                })
+                .catch(function () {
+                    lt.toast.error('Status update failed — reverting');
+                    revert();
+                });
         }
 
         Object.keys(columns).forEach(status => {