Fix 40+ codebase issues: security, performance, duplication, dead code, and routes

HIGH:
- Add missing import RadioSongRequestFormRequest (fixes crash on POST)
- Add Purify XSS sanitization for article full_story
- Fix duplicate radio API routes (/api/radio vs /api/radio/v2)
- Add try-catch guards in InstallationController for missing records

MEDIUM:
- Fix N+1: eager load comments.user in ArticleController::show()
- Fix GuestbookController authorization logic
- Remove dead doSetup() method and duplicate route
- Extract shared HasRadioDefaults trait (remove code duplication)
- Use named routes in ForceStaffTwoFactorMiddleware
- Fix WebsiteHelpCenterTicket::isOpen() (no permission leak)
- Enable  on WebsiteHelpCenterTicket (matches schema)
- Replace WebsiteTeam::all()->pluck() with direct pluck()
- Replace CatalogPage::all()->pluck() with direct pluck()
- Replace WebsiteBadge::all() with direct pluck()
- Add throttle middleware to guestbook store, logo-generator, radio embed

LOW:
- Remove unused imports
- Remove dead /inertia-test route
- Consolidate cache keys in RadioController

routes/web.php

@@ -9,15 +9,8 @@ use App\Http\Controllers\Miscellaneous\MaintenanceController;
 use App\Http\Controllers\User\BannedController;
 use Illuminate\Support\Facades\Route;
 
-// Inertia demo route
-Route::get('/inertia-test', function () {
-    return inertia('Home', [
-        'hotelName' => setting('hotel_name', 'Epicnabbo'),
-    ]);
-})->name('inertia.test');
-
 // Radio embed (public, no auth required)
-Route::get('/radio/embed', [\App\Http\Controllers\Radio\EmbedController::class, 'show'])->name('radio.embed');
+Route::get('/radio/embed', [\App\Http\Controllers\Radio\EmbedController::class, 'show'])->name('radio.embed')->middleware('throttle:60,1');
 
 // Language route
 Route::get('/language/{locale}', LocaleController::class)->name('language.select');