fix: address PR review findings - CSRF response, N+1 query, error handling

- togglePublished: return JSON on CSRF failure instead of die()
- Conditions view: fold group/rule counts into main query as subselects
  instead of N+1 per-item queries
- All 5 toggle-published templates: add .catch() for AJAX error feedback

Claude-Session: https://claude.ai/code/session_01Jo2JpjCwfHAh2HHRSjczKq

source/packages/com_mokosuiteclient/admin/src/Controller/DisplayController.php

@@ -812,7 +812,11 @@ class DisplayController extends BaseController
 
 	public function togglePublished()
 	{
-		Session::checkToken() or die(Text::_('JINVALID_TOKEN'));
+		if (!Session::checkToken())
+		{
+			$this->jsonResponse(['success' => false, 'message' => Text::_('JINVALID_TOKEN')]);
+			return;
+		}
 
 		if (!$this->checkAcl('core.admin'))
 		{