Fix remaining security vulnerabilities

- H1: Add missing sanitize() to help center content rendering
- H2: Tighten CSP by removing unsafe-inline/unsafe-eval from script-src;
  move theme init to external JS file with meta tag for defaultDark
- M1: Add SSRF protection for radio API URLs (block private IPs)
- M2: Add rate limiting to SSO ticket endpoint (5 req/30s per user)
- M4: Document locale validation safety in i18n dynamic import
- L1: Truncate stacktraces in admin commandocentrum to first 20 lines

src/app/layout.tsx

@@ -51,12 +51,8 @@ export default async function RootLayout({ children }: { children: ReactNode })
   return (
     <html lang={locale} className={`app ${nunito.variable} ${pixelFont.variable}`}>
       <head>
-        {/* Apply the saved/default theme before first paint to avoid a flash. */}
-        <script
-          dangerouslySetInnerHTML={{
-            __html: `try{var s=localStorage.getItem('theme');if(s==='dark'||(!s&&${defaultDark}))document.documentElement.classList.add('dark');var nc=localStorage.getItem('navbarColor'),nt=localStorage.getItem('navbarTextColor');if(nc)document.documentElement.style.setProperty('--color-navbar',nc);if(nt)document.documentElement.style.setProperty('--color-navbar-text',nt);}catch(e){}`,
-          }}
-        />
+        <meta name="theme-default-dark" content={String(defaultDark)} />
+        <script src="/scripts/theme-init.js" />
       </head>
       <body
         className="flex min-h-screen flex-col site-bg"