Use canUserAccessTicket() in clone_ticket.php; fix README bootstrap entry

- clone_ticket.php: replace custom visibility check with centralized canUserAccessTicket(); return 404 (not 403) for inaccessible tickets
- README.md: remove bootstrap.php from the API endpoints table (it's a shared include, not a public endpoint); correct its project structure description

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/clone_ticket.php

@@ -74,13 +74,11 @@ try {
         exit;
     }
 
-    // Authorization: non-admins cannot clone internal tickets unless they created/are assigned
-    if (!$isAdmin && ($sourceTicket['visibility'] ?? 'public') === 'internal') {
-        if ($sourceTicket['created_by'] != $userId && $sourceTicket['assigned_to'] != $userId) {
-            http_response_code(403);
-            echo json_encode(['success' => false, 'error' => 'Permission denied']);
-            exit;
-        }
+    // Verify the user can access this ticket using centralized visibility logic
+    if (!$ticketModel->canUserAccessTicket($sourceTicket, $_SESSION['user'])) {
+        http_response_code(404);
+        echo json_encode(['success' => false, 'error' => 'Source ticket not found']);
+        exit;
     }
 
     // Prepare cloned ticket data