Fix security, performance, and code quality issues across CMS

Security:
- Replace unescaped {!! !!} with Purify::clean() in 15+ Blade templates (XSS)
- Add rate limiting to register (3/hr), upload (10/min), SSE (6/min)
- Add max:5000 validation on article comments
- Remove duplicate exception handler callback

Hardcoded paths:
- Replace ~44 /var/www/ hardcoded paths with env() configs
- CatalogService (13), AutoDetectService (18), Commandocentrum (11), AppServiceProvider (2)

Performance:
- Add 10 missing database indexes (radio_song_requests, help_center_tickets, etc.)
- Replace Cache::flush() with targeted Cache::forget() in RadioSettings
- Cache getCachedCategories() in TicketController (N+1 fix)
- Remove redundant top-3 leaderboard query

Bug fixes:
- Fix undefined $enabled variable → $isOnline in radio index view
- Add getAvatarAttribute() accessor for non-existent avatar column
- Fix User::guilds() from wrong HasMany to HasManyThrough

Code quality:
- Replace file_get_contents with Http::timeout(10) in TraxService
- Remove commented Echo/Pusher boilerplate in bootstrap.js
- Remove TODO/FIXME comments from logo-generator templates
- Replace hardcoded Turnstile CDN URL with config()
- Restore QUEUE_CONNECTION=redis in .env.example files

resources/themes/dusk/views/community/article.blade.php

@@ -42,7 +42,7 @@
             </div>
 
             <div class="px-2" id="article-content">
-                {!! $article->full_story !!}
+                {{ \Stevebauman\Purify\Facades\Purify::clean($article->full_story) }}
             </div>
 
             @include('community.partials.article-reactions')

resources/themes/dusk/views/community/staff-applications.blade.php

@@ -15,7 +15,7 @@
 
                     <div class="text-center dark:text-gray-400">
                         <div class="mb-4 text-sm">
-                            {!! $position->description !!}
+                            {{ \Stevebauman\Purify\Facades\Purify::clean($position->description) }}
                         </div>
                         <div class="mb-4 text-sm font-semibold">
                             {{ __('Application Deadline :date', [

resources/themes/dusk/views/community/team-applications.blade.php

@@ -38,7 +38,7 @@
 
                     <div class="text-center dark:text-gray-400">
                         <div class="mb-4 text-sm">
-                            {!! $position->description !!}
+                            {{ \Stevebauman\Purify\Facades\Purify::clean($position->description) }}
                         </div>
                         <div class="mb-4 text-sm font-semibold">
                             {{ __('Application Deadline :date', ['date' => $position->apply_to ? $position->apply_to->format('F j, Y, g:i A') : __('No deadline set')]) }}

resources/themes/dusk/views/help-center/index.blade.php

@@ -12,7 +12,7 @@
                     <div class="px-2 text-sm text-gray-200">
                         <img class="px-2" style="float: right !important;"
                              src="{{ asset('/assets/images/help-center/' . $category->image_url) }}" alt="">
-                        {!! $category->content !!}
+                        {{ \Stevebauman\Purify\Facades\Purify::clean($category->content) }}
                     </div>
 
                     <a data-turbolinks="false" href="{{ $category->button_url ?? '#' }}" class="mt-4 ml-2">
@@ -34,7 +34,7 @@
                     </x-slot:title>
 
                     <div class="px-2 text-sm text-gray-200">
-                        {!! $category->content !!}
+                        {{ \Stevebauman\Purify\Facades\Purify::clean($category->content) }}
                     </div>
 
                     <a data-turbolinks="false" href="{{ $category->button_url ?? '#' }}" class="mt-4 ml-2">

resources/themes/dusk/views/help-center/tickets/show.blade.php

@@ -48,7 +48,7 @@
         </div>
 
         <article class="prose-xl mt-8" style="width: 100%;">
-            {!! $ticket->content !!}
+            {{ \Stevebauman\Purify\Facades\Purify::clean($ticket->content) }}
         </article>
     </x-content.content-card>
 
@@ -140,7 +140,7 @@
                         </div>
 
                         <div class="p-4">
-                            {!! $reply->content !!}
+                            {{ \Stevebauman\Purify\Facades\Purify::clean($reply->content) }}
                         </div>
                     </div>
                 @else
@@ -171,7 +171,7 @@
                         </div>
 
                         <div class="p-4">
-                            {!! $reply->content !!}
+                            {{ \Stevebauman\Purify\Facades\Purify::clean($reply->content) }}
                         </div>
                     </div>
                 @endif

resources/themes/dusk/views/logo-generator.blade.php

@@ -72,7 +72,6 @@
         </x-content.content-card>
     </div>
 
-    {{-- TODO: Selfhost --}}
     <script src="{{ config('habbo.cdn.sweetalert2_js') }}"></script>
     <script src="{{ config('habbo.cdn.html2canvas_js') }}"></script>
     <script>

resources/themes/dusk/views/maintenance.blade.php

@@ -139,7 +139,7 @@
         @endif
 
         <article class="mt-4 text-lg lg:text-xl max-w-[600px] text-wrap">
-            <p>{!! setting('maintenance_message') !!}</p>
+            <p>{{ \Stevebauman\Purify\Facades\Purify::clean(setting('maintenance_message')) }}</p>
         </article>
     </div>
 </div>
@@ -162,6 +162,6 @@
 @endguest
 </body>
 
-<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" defer></script>
+<script src="{{ config('habbo.cdn.turnstile_js', 'https://challenges.cloudflare.com/turnstile/v0/api.js') }}" defer></script>
 
 </html>