N+1 fixes:
- Add withCount('furniture') to rare categories sidebar (prevents N queries)
- Add tags and user.permission eager load in ArticleController
- Add rooms and photos.user eager load in ProfileController
- Add user eager load in MediaApiController (API was returning null user data)
SELECT * fixes:
- Replace WebsitePermission::all()->pluck() with direct pluck()
- Replace WebsiteHousekeepingPermission::all()->pluck() with direct pluck()
- Add select(['id', 'public_name']) to ItemBase query in furniItems()
- Add select(['id', 'name']) to help categories query
- Add select(['id', 'name', 'code']) to languages query
Memory/performance:
- Replace full collection load with aggregate queries in getRareStatistics()
- Add limit(50) to open tickets query in TicketController
HIGH:
- Add missing import RadioSongRequestFormRequest (fixes crash on POST)
- Add Purify XSS sanitization for article full_story
- Fix duplicate radio API routes (/api/radio vs /api/radio/v2)
- Add try-catch guards in InstallationController for missing records
MEDIUM:
- Fix N+1: eager load comments.user in ArticleController::show()
- Fix GuestbookController authorization logic
- Remove dead doSetup() method and duplicate route
- Extract shared HasRadioDefaults trait (remove code duplication)
- Use named routes in ForceStaffTwoFactorMiddleware
- Fix WebsiteHelpCenterTicket::isOpen() (no permission leak)
- Enable on WebsiteHelpCenterTicket (matches schema)
- Replace WebsiteTeam::all()->pluck() with direct pluck()
- Replace CatalogPage::all()->pluck() with direct pluck()
- Replace WebsiteBadge::all() with direct pluck()
- Add throttle middleware to guestbook store, logo-generator, radio embed
LOW:
- Remove unused imports
- Remove dead /inertia-test route
- Consolidate cache keys in RadioController
root