fix(security): authorize site uploads and harden tokens, media and request identity

src/app/api/radio/shouts/route.ts

@@ -69,7 +69,7 @@ export async function GET(_req: Request) {
 
 // Post a new radio shout as the Bearer-authed user into radio_shouts.
 export async function POST(req: Request) {
-	const uid = await bearerUserId(req);
+	const uid = await bearerUserId(req, ["radio:write"]);
 	if (!uid) return apiError("Unauthorized", 401);
 
 	if (!(await rateLimit(`radio-shout:${uid}`, 10, 60_000)).ok) {