Fix logic bugs found in third multi-agent review

Medium:
- create_ticket_api.php: environment tags were parsed with explode('][') which
  left brackets on the first/last tag so the whitelist never matched, dropping
  the env tag from the dedup hash — a [production] and [staging] issue with
  otherwise-identical components could collide onto one ticket. Use a
  bracket-aware regex.
- CommentModel::getThreadedCommentsPaged only fetched DIRECT children of root
  comments, so when pagination is active, nested replies at depth 2-3 vanished
  from the thread. Expand replies level-by-level (bounded to depth 3).
- StatsModel::getTicketsByAssignee ignored the visibility filter the rest of the
  stats apply, so a non-admin's "by assignee" widget counted (leaked) confidential
  tickets. Thread the same filter through.
- watch_ticket.php GET path returned watch state / watcher names / count for any
  ticket with no access check (the POST path checks it) — added canUserAccessTicket.
- dashboard.js kanban: every card rendered as P4 because the [class*="lt-p"]
  selector never matched the lt-badge-p1 class and the fallback didn't strip "P".
  Extract the digit directly.

Low:
- audit_log.php CSV: "Log ID" column was always blank ($log['log_id'] vs the real
  audit_id column). Use audit_id.
- check_duplicates.php: the graceful-degradation try/catch only covered the throw
  path; guard the false-return (non-exception mysqli) path too.
- notifications.php: owner-who-is-also-@mentioned got two notifications for one
  comment; drop the duplicate comment row when a mention covers the same comment.
- dashboard.js hover preview rendered "PP1" (doubled prefix); strip the leading P.
- markdown.js: code/inline-code restore used string replace, so $&, $$, $`, $' in
  user code were treated as replacement patterns; use a function replacer. Also
  removed an unused loop var.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

models/StatsModel.php

@@ -28,8 +28,14 @@ class StatsModel
     /**
      * Get tickets by assignee (top 5)
      */
-    public function getTicketsByAssignee(int $limit = 8): array
+    public function getTicketsByAssignee(int $limit = 8, array $visFilter = []): array
     {
+        // Apply the same visibility filter as the rest of the stats so a non-admin's
+        // assignee widget doesn't count (and thereby leak) confidential tickets.
+        $visSQL    = $visFilter['sql']    ?? '';
+        $visParams = $visFilter['params'] ?? [];
+        $visTypes  = $visFilter['types']  ?? '';
+
         $sql = "SELECT
                     u.user_id,
                     u.display_name,
@@ -37,12 +43,20 @@ class StatsModel
                     COUNT(t.ticket_id) as open_count
                 FROM tickets t
                 LEFT JOIN users u ON t.assigned_to = u.user_id
-                WHERE t.status != 'Closed' AND t.assigned_to IS NOT NULL
-                GROUP BY t.assigned_to
-                ORDER BY open_count DESC
-                LIMIT ?";
+                WHERE t.status != 'Closed' AND t.assigned_to IS NOT NULL";
+        if ($visSQL !== '') {
+            $sql .= " AND ($visSQL)";
+        }
+        $sql .= " GROUP BY t.assigned_to
+                  ORDER BY open_count DESC
+                  LIMIT ?";
+
+        $params   = $visParams;
+        $params[] = $limit;
+        $types    = $visTypes . 'i';
+
         $stmt = $this->conn->prepare($sql);
-        $stmt->bind_param('i', $limit);
+        $stmt->bind_param($types, ...$params);
         $stmt->execute();
         $result = $stmt->get_result();
         $data = [];
@@ -173,8 +187,9 @@ class StatsModel
         // Sort priority keys
         ksort($byPriority);
 
-        // Query 3: Get assignee stats (requires JOIN, kept separate)
-        $byAssignee = $this->getTicketsByAssignee();
+        // Query 3: Get assignee stats (requires JOIN, kept separate). Pass the same
+        // visibility filter so confidential tickets aren't counted for non-admins.
+        $byAssignee = $this->getTicketsByAssignee(8, $visFilter);
 
         return [
             'open_tickets' => (int)($counts['open_tickets'] ?? 0),