Fix remaining security vulnerabilities

- H1: Add missing sanitize() to help center content rendering
- H2: Tighten CSP by removing unsafe-inline/unsafe-eval from script-src;
  move theme init to external JS file with meta tag for defaultDark
- M1: Add SSRF protection for radio API URLs (block private IPs)
- M2: Add rate limiting to SSO ticket endpoint (5 req/30s per user)
- M4: Document locale validation safety in i18n dynamic import
- L1: Truncate stacktraces in admin commandocentrum to first 20 lines

src/app/api/client/sso/route.ts

@@ -1,6 +1,7 @@
 import { headers } from "next/headers";
 import { auth } from "@/lib/auth";
 import { prisma } from "@/lib/prisma";
+import { clientIp, rateLimit } from "@/lib/rate-limit";
 import { siteSettings } from "@/lib/services/site-settings";
 import { issueSsoTicket } from "@/lib/auth/sso-ticket";
 
@@ -13,14 +14,18 @@ export async function GET() {
   }
 
   const userId = Number(session.user.id);
+
+  // Throttle SSO ticket generation (5 per 30s per user) — prevent ticket spam.
+  if (!rateLimit(`sso:${userId}`, 5, 30_000).ok) {
+    return new Response(JSON.stringify({ error: "Rate limited" }), { status: 429 });
+  }
+
   const [hotelName, clientUrl] = await Promise.all([
     siteSettings.get("hotel_name", "Atom"),
     siteSettings.get("nitro_client_url", ""),
   ]);
 
-  const hdrs = await headers();
-  const ip =
-    hdrs.get("x-forwarded-for")?.split(",")[0]?.trim() ?? hdrs.get("x-real-ip") ?? "0.0.0.0";
+  const ip = await clientIp();
 
   const ticket = await issueSsoTicket(prisma, userId, hotelName ?? "Atom", ip);