Fix remaining security vulnerabilities

- H1: Add missing sanitize() to help center content rendering
- H2: Tighten CSP by removing unsafe-inline/unsafe-eval from script-src;
  move theme init to external JS file with meta tag for defaultDark
- M1: Add SSRF protection for radio API URLs (block private IPs)
- M2: Add rate limiting to SSO ticket endpoint (5 req/30s per user)
- M4: Document locale validation safety in i18n dynamic import
- L1: Truncate stacktraces in admin commandocentrum to first 20 lines

src/i18n/request.ts

@@ -17,6 +17,7 @@ export default getRequestConfig(async () => {
   const cookieLocale = store.get("NEXT_LOCALE")?.value;
   const locale: AppLocale = isSupportedLocale(cookieLocale) ? cookieLocale : DEFAULT_LOCALE;
 
+  // Safe: `locale` is validated against SUPPORTED_LOCALES above (only en/it/nl/de/fr/es).
   const messages = (await import(`../messages/${locale}.json`)).default;
   // English is the source of truth; fall back to it for any key missing from a
   // translation so the UI never shows a raw key path.