Fix security, performance, and code quality issues across CMS

Security:
- Replace unescaped {!! !!} with Purify::clean() in 15+ Blade templates (XSS)
- Add rate limiting to register (3/hr), upload (10/min), SSE (6/min)
- Add max:5000 validation on article comments
- Remove duplicate exception handler callback

Hardcoded paths:
- Replace ~44 /var/www/ hardcoded paths with env() configs
- CatalogService (13), AutoDetectService (18), Commandocentrum (11), AppServiceProvider (2)

Performance:
- Add 10 missing database indexes (radio_song_requests, help_center_tickets, etc.)
- Replace Cache::flush() with targeted Cache::forget() in RadioSettings
- Cache getCachedCategories() in TicketController (N+1 fix)
- Remove redundant top-3 leaderboard query

Bug fixes:
- Fix undefined $enabled variable → $isOnline in radio index view
- Add getAvatarAttribute() accessor for non-existent avatar column
- Fix User::guilds() from wrong HasMany to HasManyThrough

Code quality:
- Replace file_get_contents with Http::timeout(10) in TraxService
- Remove commented Echo/Pusher boilerplate in bootstrap.js
- Remove TODO/FIXME comments from logo-generator templates
- Replace hardcoded Turnstile CDN URL with config()
- Restore QUEUE_CONNECTION=redis in .env.example files

app/Services/AutoDetectService.php

@@ -69,7 +69,7 @@ class AutoDetectService
             return $found;
         }
 
-        return '/var/www/emulator-source';
+        return $this->emulatorPath('../emulator-source');
     }
 
     public function detectEmulatorServiceName(): string
@@ -214,9 +214,9 @@ class AutoDetectService
         }
 
         $possiblePaths = [
-            '/var/www/Client', '/var/www/client', '/var/www/Nitro', '/var/www/nitro',
-            '/var/www/html/Client', '/var/www/html/client',
-            '/var/www/atomcms/public/Client', '/var/www/atomcms/public/nitro',
+            $this->clientPath('../Client'), $this->clientPath('../client'), $this->clientPath('../Nitro'), $this->clientPath('../nitro'),
+            $this->clientPath('../../html/Client'), $this->clientPath('../../html/client'),
+            $this->clientPath('../../../atomcms/public/Client'), $this->clientPath('../../../atomcms/public/nitro'),
         ];
 
         foreach ($possiblePaths as $path) {
@@ -225,7 +225,7 @@ class AutoDetectService
             }
         }
 
-        return '/var/www/Client';
+        return $this->clientPath('../Client');
     }
 
     public function detectNitroBuildPath(): string
@@ -247,8 +247,8 @@ class AutoDetectService
         }
 
         $possiblePaths = [
-            '/var/www/nitro-client/dist', '/var/www/nitro-V3/dist',
-            '/var/www/atomcms/nitro-client/dist',
+            $this->clientPath('dist'), $this->clientPath('../nitro-V3/dist'),
+            base_path('nitro-client/dist'),
         ];
 
         foreach ($possiblePaths as $path) {
@@ -290,7 +290,7 @@ class AutoDetectService
 
         // Last resort: check common paths
         $possiblePaths = [
-            '/var/www/atomcms/public/gamedata', '/var/www/html/gamedata',
+            $this->gamedataPath('../../../atomcms/public/gamedata'), $this->gamedataPath('../../html/gamedata'),
             '/opt/gamedata', '/root/gamedata',
         ];
 
@@ -300,7 +300,7 @@ class AutoDetectService
             }
         }
 
-        return '/var/www/gamedata';
+        return $this->gamedataPath('../gamedata');
     }
 
     public function detectFurnitureIconsPath(): string
@@ -317,7 +317,7 @@ class AutoDetectService
             return $iconsPath;
         }
 
-        return '/var/www/Gamedata/icons';
+        return $this->gamedataPath('../icons');
     }
 
     public function detectCatalogIconsPath(): string
@@ -334,7 +334,7 @@ class AutoDetectService
             return $cataloguePath;
         }
 
-        return '/var/www/Gamedata/catalogue';
+        return $this->gamedataPath('../catalogue');
     }
 
     // ─── Nginx ─────────────────────────────────────────────────
@@ -700,6 +700,39 @@ class AutoDetectService
         return trim($result->output()) === 'yes';
     }
 
+    private function emulatorPath(string $path = ''): string
+    {
+        $base = env('NITRO_EMULATOR_PATH', '/var/www/emulator');
+
+        if ($path === '') {
+            return $base;
+        }
+
+        return rtrim($base, '/') . '/' . ltrim($path, '/');
+    }
+
+    private function clientPath(string $path = ''): string
+    {
+        $base = env('NITRO_CLIENT_DIR', '/var/www/nitro-client');
+
+        if ($path === '') {
+            return $base;
+        }
+
+        return rtrim($base, '/') . '/' . ltrim($path, '/');
+    }
+
+    private function gamedataPath(string $path = ''): string
+    {
+        $base = env('NITRO_GAMEDATA_DIR', '/var/www/Gamedata/config');
+
+        if ($path === '') {
+            return $base;
+        }
+
+        return rtrim($base, '/') . '/' . ltrim($path, '/');
+    }
+
     private function getSetting(string $key): ?string
     {
         try {