Fix remaining security vulnerabilities

- H1: Add missing sanitize() to help center content rendering
- H2: Tighten CSP by removing unsafe-inline/unsafe-eval from script-src;
  move theme init to external JS file with meta tag for defaultDark
- M1: Add SSRF protection for radio API URLs (block private IPs)
- M2: Add rate limiting to SSO ticket endpoint (5 req/30s per user)
- M4: Document locale validation safety in i18n dynamic import
- L1: Truncate stacktraces in admin commandocentrum to first 20 lines

src/app/help/[category]/page.tsx

@@ -3,6 +3,7 @@ import Link from "next/link";
 import { notFound } from "next/navigation";
 import { ContentCard } from "@/components/public/ui";
 import { prisma } from "@/lib/prisma";
+import { sanitize } from "@/lib/sanitize";
 import { siteSettings } from "@/lib/services/site-settings";
 
 export const dynamic = "force-dynamic";
@@ -116,11 +117,10 @@ export default async function HelpCategoryPage({
           />
         ) : null}
 
-        {/* content is author-supplied HTML in AtomCMS (rendered raw with {!! !!}). */}
+        {/* content is author-supplied HTML — sanitised server-side. */}
         <div
           style={{ lineHeight: 1.7 }}
-          // biome-ignore lint/security/noDangerouslySetInnerHtml: author-supplied help content, matches AtomCMS Blade
-          dangerouslySetInnerHTML={{ __html: content }}
+          dangerouslySetInnerHTML={{ __html: sanitize(content) }}
         />
 
         {hasButton ? (