Fix logic bugs found in third multi-agent review

Medium:
- create_ticket_api.php: environment tags were parsed with explode('][') which
  left brackets on the first/last tag so the whitelist never matched, dropping
  the env tag from the dedup hash — a [production] and [staging] issue with
  otherwise-identical components could collide onto one ticket. Use a
  bracket-aware regex.
- CommentModel::getThreadedCommentsPaged only fetched DIRECT children of root
  comments, so when pagination is active, nested replies at depth 2-3 vanished
  from the thread. Expand replies level-by-level (bounded to depth 3).
- StatsModel::getTicketsByAssignee ignored the visibility filter the rest of the
  stats apply, so a non-admin's "by assignee" widget counted (leaked) confidential
  tickets. Thread the same filter through.
- watch_ticket.php GET path returned watch state / watcher names / count for any
  ticket with no access check (the POST path checks it) — added canUserAccessTicket.
- dashboard.js kanban: every card rendered as P4 because the [class*="lt-p"]
  selector never matched the lt-badge-p1 class and the fallback didn't strip "P".
  Extract the digit directly.

Low:
- audit_log.php CSV: "Log ID" column was always blank ($log['log_id'] vs the real
  audit_id column). Use audit_id.
- check_duplicates.php: the graceful-degradation try/catch only covered the throw
  path; guard the false-return (non-exception mysqli) path too.
- notifications.php: owner-who-is-also-@mentioned got two notifications for one
  comment; drop the duplicate comment row when a mention covers the same comment.
- dashboard.js hover preview rendered "PP1" (doubled prefix); strip the leading P.
- markdown.js: code/inline-code restore used string replace, so $&, $$, $`, $' in
  user code were treated as replacement patterns; use a function replacer. Also
  removed an unused loop var.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

api/audit_log.php

@@ -70,7 +70,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
             }
 
             fputcsv($output, [
-                $log['log_id'],
+                $log['audit_id'] ?? ($log['log_id'] ?? ''),
                 $log['created_at'],
                 $log['display_name'] ?? $log['username'] ?? 'N/A',
                 $log['action_type'],

api/check_duplicates.php

@@ -64,6 +64,11 @@ try {
     }
     $stmt->execute();
     $result = $stmt->get_result();
+    if ($result === false) {
+        // Non-exception mysqli mode: execute/get_result return false instead of
+        // throwing. Treat as a query failure so we don't fatal on $result below.
+        throw new RuntimeException('query failed: ' . $conn->error);
+    }
 } catch (Throwable $e) {
     error_log('check_duplicates: ' . $e->getMessage());
     ResponseHelper::success(['duplicates' => []]);

api/notifications.php

@@ -175,6 +175,23 @@ $stmt->execute();
 $mentionRows = $stmt->get_result()->fetch_all(MYSQLI_ASSOC);
 $stmt->close();
 
+// If the user owns/watches a ticket AND was @mentioned in the same comment, the
+// comment query and the mention query both produce a row for it. Prefer the more
+// specific mention and drop the duplicate comment notification for that comment.
+$mentionCommentIds = [];
+foreach ($mentionRows as $mr) {
+    $md = json_decode($mr['details'] ?? '{}', true) ?? [];
+    if (!empty($md['comment_id'])) {
+        $mentionCommentIds[(int)$md['comment_id']] = true;
+    }
+}
+if (!empty($mentionCommentIds)) {
+    $commentRows = array_filter(
+        $commentRows,
+        fn($cr) => !isset($mentionCommentIds[(int)($cr['entity_id'] ?? 0)])
+    );
+}
+
 // Merge, deduplicate by log_id, sort by created_at desc
 $all = [];
 $seen = [];

api/watch_ticket.php

@@ -78,6 +78,17 @@ if ($ticketId <= 0) {
     exit;
 }
 
+// Enforce ticket visibility before returning watch state / watcher names, so a
+// restricted ticket's watcher list and count aren't disclosed (the POST path
+// already checks this).
+$ticketModel = new TicketModel($conn);
+$ticket = $ticketModel->getTicketById($ticketId);
+if (!$ticket || !$ticketModel->canUserAccessTicket($ticket, $currentUser)) {
+    http_response_code(404);
+    echo json_encode(['success' => false, 'error' => 'Ticket not found']);
+    exit;
+}
+
 $watchingStmt = $conn->prepare(
     "SELECT COUNT(*) as cnt FROM ticket_watchers WHERE ticket_id = ? AND user_id = ?"
 );