Close the web-feasible 100% gaps: REST write/token API, tickets, draw-badge, /me, sanitisation, dusk, radio SSE

Final parity push (web-tier only):
- REST API write + token auth: POST /api/tokens (issue a personal_access_token
  for the session user), Bearer auth via src/lib/api-auth.ts, POST
  /api/articles/[slug]/comment, GET/DELETE /api/me/tokens, full tickets API
  (/api/tickets +[id] +[id]/reply), radio current-dj/points/points-leaderboard/
  embed-config + POST shouts, and a real-time /api/radio/stream (SSE). 31 public
  API routes total.
- Pages: /draw-badge (buy a custom profile badge → credits + RCON), /me
  dashboard (stats + online friends + referral claim). Wired into the nav.
- HTML sanitisation (sanitize-html) — the HTMLPurifier equivalent — applied to
  writeable boxes + article bodies before dangerouslySetInnerHTML.
- "Dusk" dark theme preset + a default-dark site option honoured by the
  no-flash boot script.

Verified live (prod, amx_test): token issue → Bearer endpoint 200, no-token
401; /api/me/tokens lists it; current-dj/leaderboard JSON; /me + /draw-badge
200; reverted the test user + tokens. tsc 0, vitest 49/49, next build 0.

src/lib/api-auth.ts

@@ -0,0 +1,64 @@
+import { createHash, randomBytes } from "node:crypto";
+import { prisma } from "@/lib/prisma";
+
+/**
+ * Bearer-token auth for the public REST API, backed by personal_access_tokens
+ * (the Laravel Sanctum table that already exists in the emulator DB). Tokens are
+ * stored as the sha256 of the plaintext; the client sends the plaintext (or the
+ * Sanctum "{id}|{plaintext}" form) as `Authorization: Bearer …`.
+ *
+ * NOTE: the live amx_test table has NO expires_at column — never read/write it.
+ */
+const TOKENABLE_TYPE = "App\\Models\\User";
+
+function hashToken(raw: string): string {
+  return createHash("sha256").update(raw).digest("hex");
+}
+
+/** Resolve the user id behind a Bearer token, or null. */
+export async function bearerUserId(req: Request): Promise<number | null> {
+  const header = req.headers.get("authorization") ?? "";
+  const m = header.match(/^Bearer\s+(.+)$/i);
+  if (!m) return null;
+  let raw = m[1].trim();
+  const pipe = raw.indexOf("|");
+  if (pipe >= 0) raw = raw.slice(pipe + 1); // Sanctum "{id}|{token}"
+  if (!raw) return null;
+
+  try {
+    const row = await prisma.personalAccessTokens.findFirst({
+      where: { token: hashToken(raw) },
+      select: { id: true, tokenableId: true },
+    });
+    if (!row) return null;
+    // Best-effort last-used stamp (don't fail the request if it errors).
+    prisma.personalAccessTokens
+      .update({ where: { id: row.id }, data: { lastUsedAt: new Date() }, select: { id: true } })
+      .catch(() => {});
+    return Number(row.tokenableId);
+  } catch {
+    return null;
+  }
+}
+
+/** Mint a new token for a user. Returns the plaintext (shown once). */
+export async function issueToken(userId: number, name = "api"): Promise<string | null> {
+  const plaintext = randomBytes(32).toString("hex");
+  try {
+    await prisma.personalAccessTokens.create({
+      data: {
+        tokenableId: BigInt(userId),
+        tokenableType: TOKENABLE_TYPE,
+        name: name.slice(0, 100),
+        token: hashToken(plaintext),
+        abilities: '["*"]',
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      },
+      select: { id: true },
+    });
+    return plaintext;
+  } catch {
+    return null;
+  }
+}

src/lib/sanitize.ts

@@ -0,0 +1,45 @@
+import sanitizeHtml from "sanitize-html";
+
+/**
+ * Server-side HTML sanitiser for user/staff-authored rich content before it is
+ * injected via dangerouslySetInnerHTML — the AtomCMS HTMLPurifier equivalent.
+ * Allows a safe formatting subset (no <script>/<style>/<iframe>, no on* event
+ * handlers, no javascript: URLs); images/links are permitted with safe schemes.
+ */
+const OPTIONS: sanitizeHtml.IOptions = {
+  allowedTags: [
+    "a", "b", "i", "em", "strong", "u", "s", "p", "br", "hr", "span", "div",
+    "ul", "ol", "li", "blockquote", "code", "pre",
+    "h1", "h2", "h3", "h4", "h5", "h6",
+    "img", "figure", "figcaption", "table", "thead", "tbody", "tr", "th", "td",
+  ],
+  allowedAttributes: {
+    a: ["href", "title", "target", "rel"],
+    img: ["src", "alt", "title", "width", "height"],
+    "*": ["style", "class"],
+  },
+  allowedSchemes: ["http", "https", "mailto"],
+  allowedSchemesByTag: { img: ["http", "https", "data"] },
+  // Drop any style declarations that aren't simple, safe properties.
+  allowedStyles: {
+    "*": {
+      color: [/.*/],
+      "background-color": [/.*/],
+      "text-align": [/^left$|^right$|^center$|^justify$/],
+      "font-weight": [/.*/],
+      "font-style": [/.*/],
+      "text-decoration": [/.*/],
+      "font-size": [/.*/],
+      margin: [/.*/],
+      padding: [/.*/],
+    },
+  },
+  transformTags: {
+    a: sanitizeHtml.simpleTransform("a", { rel: "noopener noreferrer nofollow" }),
+  },
+};
+
+export function sanitize(html: string | null | undefined): string {
+  if (!html) return "";
+  return sanitizeHtml(html, OPTIONS);
+}

src/lib/theme-presets.ts

@@ -226,4 +226,18 @@ export const PRESETS: Record<string, Record<string, string>> = {
     button_text_color: "#ffffff",
     border_color: "#16a34a",
   },
+  Dusk: {
+    color_primary: "#e8a33d",
+    color_background: "#1b2230",
+    color_surface: "#232c3d",
+    color_dropdown: "#2b3548",
+    color_navbar: "#232c3d",
+    color_navbar_text: "#dfe5ef",
+    color_text: "#dfe5ef",
+    color_text_muted: "#94a0b5",
+    color_accent: "#5eb0c9",
+    button_primary_color: "#e8a33d",
+    button_text_color: "#1b2230",
+    border_color: "#e8a33d",
+  },
 };