Fix 40+ codebase issues: security, performance, duplication, dead code, and routes

HIGH:
- Add missing import RadioSongRequestFormRequest (fixes crash on POST)
- Add Purify XSS sanitization for article full_story
- Fix duplicate radio API routes (/api/radio vs /api/radio/v2)
- Add try-catch guards in InstallationController for missing records

MEDIUM:
- Fix N+1: eager load comments.user in ArticleController::show()
- Fix GuestbookController authorization logic
- Remove dead doSetup() method and duplicate route
- Extract shared HasRadioDefaults trait (remove code duplication)
- Use named routes in ForceStaffTwoFactorMiddleware
- Fix WebsiteHelpCenterTicket::isOpen() (no permission leak)
- Enable  on WebsiteHelpCenterTicket (matches schema)
- Replace WebsiteTeam::all()->pluck() with direct pluck()
- Replace CatalogPage::all()->pluck() with direct pluck()
- Replace WebsiteBadge::all() with direct pluck()
- Add throttle middleware to guestbook store, logo-generator, radio embed

LOW:
- Remove unused imports
- Remove dead /inertia-test route
- Consolidate cache keys in RadioController

app/Http/Controllers/RadioSongRequestController.php

@@ -2,7 +2,7 @@
 
 namespace App\Http\Controllers;
 
-use App\Models\Miscellaneous\WebsiteSetting;
+use App\Http\Requests\RadioSongRequestFormRequest;
 use App\Models\RadioSongRequest;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Support\Facades\Cache;
@@ -12,7 +12,7 @@ class RadioSongRequestController extends Controller
 {
     private function isRequestsEnabled(): bool
     {
-        return Cache::remember('radio_requests_enabled', 60, fn () => (bool) WebsiteSetting::where('key', 'radio_requests_enabled')->first()?->value);
+        return Cache::remember('radio_requests_enabled', 60, fn () => (bool) \App\Models\Miscellaneous\WebsiteSetting::where('key', 'radio_requests_enabled')->first()?->value);
     }
 
     public function index(): View|RedirectResponse