Audit fixes: security, dead code removal, API consolidation, JS dedup

Security:
- Fix IDOR in delete/update comment (add ticket visibility check)
- XSS defense-in-depth in DashboardView active filters
- Replace innerHTML with DOM construction in toast.js
- Remove redundant real_escape_string in check_duplicates
- Add rate limiting to get_template, download_attachment, audit_log,
  saved_filters, user_preferences endpoints

Bug fixes:
- Session timeout now reads from config instead of hardcoded 18000
- TicketController uses $GLOBALS['config'] instead of duplicate .env parsing
- Add DISCORD_WEBHOOK_URL to centralized config
- Cleanup script uses hashmap for O(1) ticket ID lookups

Dead code removal (~100 lines):
- Remove dead getTicketComments() from TicketModel (wrong bind_param type)
- Remove dead getCategories()/getTypes() from DashboardController
- Remove ~80 lines dead Discord webhook code from update_ticket API

Consolidation:
- Create api/bootstrap.php for shared API setup (auth, CSRF, rate limit)
- Convert 6 API endpoints to use bootstrap
- Extract escapeHtml/getTicketIdFromUrl into shared utils.js
- Batch save for user preferences (1 request instead of 7)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

middleware/AuthMiddleware.php

@@ -60,7 +60,8 @@ class AuthMiddleware {
             ini_set('session.cookie_secure', 1); // Requires HTTPS
             ini_set('session.cookie_samesite', 'Lax'); // Lax allows redirects from Authelia
             ini_set('session.use_strict_mode', 1);
-            ini_set('session.gc_maxlifetime', 18000); // 5 hours
+            $sessionTimeout = $GLOBALS['config']['SESSION_TIMEOUT'] ?? 18000;
+            ini_set('session.gc_maxlifetime', $sessionTimeout);
             ini_set('session.cookie_lifetime', 0); // Until browser closes
 
             session_start();
@@ -68,8 +69,9 @@ class AuthMiddleware {
 
         // Check if user is already authenticated in session
         if (isset($_SESSION['user']) && isset($_SESSION['user']['user_id'])) {
-            // Verify session hasn't expired (5 hour timeout)
-            if (isset($_SESSION['last_activity']) && (time() - $_SESSION['last_activity'] > 18000)) {
+            // Verify session hasn't expired
+            $sessionTimeout = $GLOBALS['config']['SESSION_TIMEOUT'] ?? 18000;
+            if (isset($_SESSION['last_activity']) && (time() - $_SESSION['last_activity'] > $sessionTimeout)) {
                 // Log session expiration
                 $this->logSecurityEvent('session_expired', [
                     'username' => $_SESSION['user']['username'] ?? 'unknown',