Fix remaining security vulnerabilities

- H1: Add missing sanitize() to help center content rendering
- H2: Tighten CSP by removing unsafe-inline/unsafe-eval from script-src;
  move theme init to external JS file with meta tag for defaultDark
- M1: Add SSRF protection for radio API URLs (block private IPs)
- M2: Add rate limiting to SSO ticket endpoint (5 req/30s per user)
- M4: Document locale validation safety in i18n dynamic import
- L1: Truncate stacktraces in admin commandocentrum to first 20 lines

public/scripts/theme-init.js

@@ -0,0 +1,12 @@
+(function(){
+  try {
+    var s=localStorage.getItem('theme');
+    var dd=document.querySelector('meta[name="theme-default-dark"]');
+    var defaultDark=dd?dd.getAttribute('content')==='true':false;
+    if(s==='dark'||(!s&&defaultDark))document.documentElement.classList.add('dark');
+    var nc=localStorage.getItem('navbarColor'),
+        nt=localStorage.getItem('navbarTextColor');
+    if(nc)document.documentElement.style.setProperty('--color-navbar',nc);
+    if(nt)document.documentElement.style.setProperty('--color-navbar-text',nt);
+  }catch(e){}
+})();