fix: resolve 5 bugs — auth, ownership, crash, notification, and HTML issues

- dashboard.php: fix PDO parameter count crash for users with no groups
  (used max(count,1) for placeholder count but provided 0 group params)
- index.php: add missing auth check on get_tasks_status API endpoint
  (was accessible without a session, exposing all task data)
- index.php: enforce ownership check on delete_comment API
  (any logged-in user could delete any comment; now requires authorship or admin)
- tasks.php: fix task creation notification using undefined $_SESSION['username']
  (replaced with $current_user['username'] so {assignor} template works correctly)
- tasks.php: remove duplicate id attribute on att-lightbox-body element

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

views/dashboard.php

@@ -17,7 +17,7 @@ try {
 // ── Task Counts ───────────────────────────────────────────────────────────────
 $user_groups   = get_user_groups($user_id);
 $my_group_ids  = array_column($user_groups, 'id');
-$group_in      = implode(',', array_fill(0, max(count($my_group_ids), 1), '?')) ?: '0';
+$group_in      = $my_group_ids ? implode(',', array_fill(0, count($my_group_ids), '?')) : '0';
 $params_tasks  = array_merge([$user_id, $user_id], $my_group_ids, $my_group_ids, [$user_id]);
 $sql_tasks = "SELECT status, COUNT(*) as cnt FROM tasks WHERE
     (assignee_type='user'  AND assignee_id=?)