fix: resolve 5 bugs — auth, ownership, crash, notification, and HTML issues

- dashboard.php: fix PDO parameter count crash for users with no groups
  (used max(count,1) for placeholder count but provided 0 group params)
- index.php: add missing auth check on get_tasks_status API endpoint
  (was accessible without a session, exposing all task data)
- index.php: enforce ownership check on delete_comment API
  (any logged-in user could delete any comment; now requires authorship or admin)
- tasks.php: fix task creation notification using undefined $_SESSION['username']
  (replaced with $current_user['username'] so {assignor} template works correctly)
- tasks.php: remove duplicate id attribute on att-lightbox-body element

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

index.php

@@ -96,14 +96,23 @@ if ($action === 'api') {
         if(!isset($_SESSION['user_id'])) die(json_encode(['status'=>'error','msg'=>'unauthorized']));
         $comment_id = $_POST['comment_id'] ?? null;
         if($comment_id) {
-            $stmt = $pdo->prepare("DELETE FROM task_comments WHERE id = ?");
-            $stmt->execute([$comment_id]);
+            $user_id = $_SESSION['user_id'];
+            $is_admin = !empty($_SESSION['is_admin']);
+            $comment_check = query("SELECT created_by FROM task_comments WHERE id = ?", [$comment_id])->fetch();
+            if($comment_check && ($comment_check['created_by'] == $user_id || $is_admin)) {
+                $stmt = $pdo->prepare("DELETE FROM task_comments WHERE id = ?");
+                $stmt->execute([$comment_id]);
+            } else {
+                echo json_encode(['status'=>'error','msg'=>'forbidden']);
+                exit;
+            }
         }
         echo json_encode(['status'=>'ok']);
         exit;
     }
 
     if($api_action === 'get_tasks_status') {
+        if(!isset($_SESSION['user_id'])) die(json_encode(['status'=>'error','msg'=>'unauthorized']));
         $task_id = $_GET['task_id'] ?? null;
 
         // Correlated subquery gives attachment count per task.