fix: CSRF token staleness causing intermittent 403 on POST actions

Root cause: bootstrap.php rotates the CSRF token on every successful POST,
but most API endpoints called echo json_encode() directly instead of
apiRespond() — so the rotated token was never returned to the client.
The next POST from the same page sent the now-invalid old token → 403.
Refreshing the page loaded a fresh token, making it work once.

Fixes:
- assign_ticket.php, watch_ticket.php: switch to apiRespond()
- saved_filters.php, user_preferences.php: replace all echo json_encode
  calls with apiRespond() (19 and 12 call sites respectively)
- base.js: both apiFetch() and _apiFetchAuth() now update window.CSRF_TOKEN
  whenever a response includes a csrf_token field, keeping the client
  permanently in sync with server-side rotations

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/assign_ticket.php

@@ -82,7 +82,7 @@ if ($assignedTo === null || $assignedTo === '') {
 
 if (!$success) {
     http_response_code(500);
-    echo json_encode(['success' => false, 'error' => 'Failed to update ticket assignment']);
+    apiRespond(['success' => false, 'error' => 'Failed to update ticket assignment']);
 } else {
-    echo json_encode(['success' => true]);
+    apiRespond(['success' => true]);
 }