Fix 40+ codebase issues: security, performance, duplication, dead code, and routes

HIGH:
- Add missing import RadioSongRequestFormRequest (fixes crash on POST)
- Add Purify XSS sanitization for article full_story
- Fix duplicate radio API routes (/api/radio vs /api/radio/v2)
- Add try-catch guards in InstallationController for missing records

MEDIUM:
- Fix N+1: eager load comments.user in ArticleController::show()
- Fix GuestbookController authorization logic
- Remove dead doSetup() method and duplicate route
- Extract shared HasRadioDefaults trait (remove code duplication)
- Use named routes in ForceStaffTwoFactorMiddleware
- Fix WebsiteHelpCenterTicket::isOpen() (no permission leak)
- Enable  on WebsiteHelpCenterTicket (matches schema)
- Replace WebsiteTeam::all()->pluck() with direct pluck()
- Replace CatalogPage::all()->pluck() with direct pluck()
- Replace WebsiteBadge::all() with direct pluck()
- Add throttle middleware to guestbook store, logo-generator, radio embed

LOW:
- Remove unused imports
- Remove dead /inertia-test route
- Consolidate cache keys in RadioController

routes/admin.php

@@ -9,7 +9,6 @@ use Illuminate\Support\Facades\Route;
 Route::prefix('admin')->middleware(['auth', 'admin.security'])->group(function () {
     Route::get('/radio/setup', [RadioSetupController::class, 'index'])->name('admin.radio.setup');
     Route::post('/radio/setup', [RadioSetupController::class, 'setup'])->name('admin.radio.setup.post');
-    Route::post('/radio/setup/do', [RadioSetupController::class, 'doSetup'])->name('admin.radio.setup.do');
     Route::post('/radio/setup/reset', [RadioSetupController::class, 'reset'])->name('admin.radio.setup.reset');
 
     // Radio wizard (multi-step)

routes/api.php

@@ -114,7 +114,7 @@ Route::post('/photos/upload', [MediaApiController::class, 'upload'])->middleware
 Route::post('/shop/packages/{packageId}/purchase', [ShopApiController::class, 'purchase'])->middleware('auth:sanctum');
 
 // Protected Radio API (requires API key)
-Route::prefix('radio')->middleware(['radio.api', 'throttle:radio'])->group(function () {
+Route::prefix('radio/v2')->middleware(['radio.api', 'throttle:radio'])->group(function () {
     Route::get('/current-dj', [RadioController::class, 'currentDJ'])->name('api.radio.v2.current-dj');
     Route::get('/now-playing', [RadioController::class, 'nowPlaying'])->name('api.radio.v2.now-playing');
     Route::get('/listeners', [RadioController::class, 'listeners'])->name('api.radio.v2.listeners');

routes/client.php

@@ -13,4 +13,4 @@ Route::prefix('game')->middleware(['findretros.redirect', 'vpn.checker'])->group
 
 // Logo generator
 Route::get('/logo-generator', [LogoGeneratorController::class, 'index'])->name('logo-generator.index');
-Route::post('/logo-generator', [LogoGeneratorController::class, 'store'])->name('store.generated-logo');
+Route::post('/logo-generator', [LogoGeneratorController::class, 'store'])->name('store.generated-logo')->middleware('throttle:10,10');

routes/user.php

@@ -21,7 +21,7 @@ Route::prefix('user')->group(function () {
     });
 
     // Guestbook
-    Route::post('/profile/{user}/guestbook', [GuestbookController::class, 'store'])->name('guestbook.store');
+    Route::post('/profile/{user}/guestbook', [GuestbookController::class, 'store'])->name('guestbook.store')->middleware('throttle:5,1');
     Route::delete('/profile/{user}/{guestbook}/delete', [GuestbookController::class, 'destroy'])->name('guestbook.destroy');
 
     // Settings

routes/web.php

@@ -9,15 +9,8 @@ use App\Http\Controllers\Miscellaneous\MaintenanceController;
 use App\Http\Controllers\User\BannedController;
 use Illuminate\Support\Facades\Route;
 
-// Inertia demo route
-Route::get('/inertia-test', function () {
-    return inertia('Home', [
-        'hotelName' => setting('hotel_name', 'Epicnabbo'),
-    ]);
-})->name('inertia.test');
-
 // Radio embed (public, no auth required)
-Route::get('/radio/embed', [\App\Http\Controllers\Radio\EmbedController::class, 'show'])->name('radio.embed');
+Route::get('/radio/embed', [\App\Http\Controllers\Radio\EmbedController::class, 'show'])->name('radio.embed')->middleware('throttle:60,1');
 
 // Language route
 Route::get('/language/{locale}', LocaleController::class)->name('language.select');