Audit fixes: security, dead code removal, API consolidation, JS dedup

Security:
- Fix IDOR in delete/update comment (add ticket visibility check)
- XSS defense-in-depth in DashboardView active filters
- Replace innerHTML with DOM construction in toast.js
- Remove redundant real_escape_string in check_duplicates
- Add rate limiting to get_template, download_attachment, audit_log,
  saved_filters, user_preferences endpoints

Bug fixes:
- Session timeout now reads from config instead of hardcoded 18000
- TicketController uses $GLOBALS['config'] instead of duplicate .env parsing
- Add DISCORD_WEBHOOK_URL to centralized config
- Cleanup script uses hashmap for O(1) ticket ID lookups

Dead code removal (~100 lines):
- Remove dead getTicketComments() from TicketModel (wrong bind_param type)
- Remove dead getCategories()/getTypes() from DashboardController
- Remove ~80 lines dead Discord webhook code from update_ticket API

Consolidation:
- Create api/bootstrap.php for shared API setup (auth, CSRF, rate limit)
- Convert 6 API endpoints to use bootstrap
- Extract escapeHtml/getTicketIdFromUrl into shared utils.js
- Batch save for user preferences (1 request instead of 7)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/cleanup_orphan_uploads.php

@@ -32,8 +32,11 @@ echo "Scanning uploads directory: $uploadsDir\n";
 // Get all valid ticket IDs from database
 $ticketIds = [];
 $result = $conn->query("SELECT ticket_id FROM tickets");
+if (!$result) {
+    die("Failed to query tickets: " . $conn->error . "\n");
+}
 while ($row = $result->fetch_assoc()) {
-    $ticketIds[] = $row['ticket_id'];
+    $ticketIds[$row['ticket_id']] = true;
 }
 echo "Found " . count($ticketIds) . " tickets in database\n";
 
@@ -63,7 +66,7 @@ foreach ($ticketDirs as $ticketDir) {
     }
 
     // Check if ticket exists
-    if (!in_array($ticketId, $ticketIds)) {
+    if (!isset($ticketIds[$ticketId])) {
         // Ticket doesn't exist - entire folder is orphaned
         $orphanedFolders[] = $ticketDir;
         $folderSize = 0;