Add comment threading and fix fetch authentication

- Add comment threading/reply functionality with nested display
  - Database migration for parent_comment_id and thread_depth columns
  - Recursive comment rendering with depth-based indentation
  - Reply form with inline UI and smooth animations
  - Thread collapse/expand capability
  - Max thread depth of 3 levels

- Fix 401 authentication errors on API calls
  - Add credentials: 'same-origin' to all fetch calls
  - Affects settings.js, ticket.js, dashboard.js, advanced-search.js
  - Ensures session cookies are sent with requests

- Enhanced comment styling
  - Thread connector lines for visual hierarchy
  - Reply button on comments (up to depth 3)
  - Quote block styling for replies

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

assets/js/advanced-search.js

@@ -35,7 +35,9 @@ function closeOnAdvancedSearchBackdropClick(event) {
 // Load users for dropdown
 async function loadUsersForSearch() {
     try {
-        const response = await fetch('/api/get_users.php');
+        const response = await fetch('/api/get_users.php', {
+            credentials: 'same-origin'
+        });
         const data = await response.json();
 
         if (data.success && data.users) {
@@ -163,6 +165,7 @@ async function saveCurrentFilter() {
             try {
                 const response = await fetch('/api/saved_filters.php', {
                     method: 'POST',
+                    credentials: 'same-origin',
                     headers: {
                         'Content-Type': 'application/json',
                         'X-CSRF-Token': window.CSRF_TOKEN
@@ -230,7 +233,9 @@ function getCurrentFilterCriteria() {
 // Load saved filters
 async function loadSavedFilters() {
     try {
-        const response = await fetch('/api/saved_filters.php');
+        const response = await fetch('/api/saved_filters.php', {
+            credentials: 'same-origin'
+        });
         const data = await response.json();
 
         if (data.success && data.filters) {
@@ -326,6 +331,7 @@ async function deleteSavedFilter() {
             try {
                 const response = await fetch('/api/saved_filters.php', {
                     method: 'DELETE',
+                    credentials: 'same-origin',
                     headers: {
                         'Content-Type': 'application/json',
                         'X-CSRF-Token': window.CSRF_TOKEN