Close the web-feasible 100% gaps: REST write/token API, tickets, draw-badge, /me, sanitisation, dusk, radio SSE

Final parity push (web-tier only):
- REST API write + token auth: POST /api/tokens (issue a personal_access_token
  for the session user), Bearer auth via src/lib/api-auth.ts, POST
  /api/articles/[slug]/comment, GET/DELETE /api/me/tokens, full tickets API
  (/api/tickets +[id] +[id]/reply), radio current-dj/points/points-leaderboard/
  embed-config + POST shouts, and a real-time /api/radio/stream (SSE). 31 public
  API routes total.
- Pages: /draw-badge (buy a custom profile badge → credits + RCON), /me
  dashboard (stats + online friends + referral claim). Wired into the nav.
- HTML sanitisation (sanitize-html) — the HTMLPurifier equivalent — applied to
  writeable boxes + article bodies before dangerouslySetInnerHTML.
- "Dusk" dark theme preset + a default-dark site option honoured by the
  no-flash boot script.

Verified live (prod, amx_test): token issue → Bearer endpoint 200, no-token
401; /api/me/tokens lists it; current-dj/leaderboard JSON; /me + /draw-badge
200; reverted the test user + tokens. tsc 0, vitest 49/49, next build 0.

src/app/api/radio/shouts/route.ts

@@ -1,11 +1,15 @@
-import { apiJson } from "@/lib/api";
+import { apiJson, apiError } from "@/lib/api";
 import { prisma } from "@/lib/prisma";
+import { bearerUserId } from "@/lib/api-auth";
 
 // Latest 50 radio shouts with their author's username/look resolved. Mirrors the
 // query behind the public /radio/shouts page (radio_shouts ordered by created_at
 // desc, then joined to users by user_id).
 export const dynamic = "force-dynamic";
 
+// Max shout length (radio_shouts.message is TEXT; cap to keep posts sane).
+const MAX_MESSAGE_LENGTH = 255;
+
 export async function GET(_req: Request) {
   try {
     const shouts = await prisma.radioShouts.findMany({
@@ -42,3 +46,37 @@ export async function GET(_req: Request) {
     return apiJson({ shouts: [] }, { status: 200 });
   }
 }
+
+// Post a new radio shout as the Bearer-authed user into radio_shouts.
+export async function POST(req: Request) {
+  const uid = await bearerUserId(req);
+  if (!uid) return apiError("Unauthorized", 401);
+
+  const body = (await req.json().catch(() => ({}))) as { message?: unknown };
+  const message = typeof body.message === "string" ? body.message.trim() : "";
+
+  if (!message) {
+    return apiError("Message is required", 422);
+  }
+  if (message.length > MAX_MESSAGE_LENGTH) {
+    return apiError(`Message must be at most ${MAX_MESSAGE_LENGTH} characters`, 422);
+  }
+
+  try {
+    const now = new Date();
+    await prisma.radioShouts.create({
+      data: {
+        userId: BigInt(uid),
+        message,
+        createdAt: now,
+        updatedAt: now,
+      },
+      select: { id: true },
+    });
+
+    return apiJson({ ok: true });
+  } catch {
+    // DB write failed — fail soft rather than a 500.
+    return apiError("Could not post shout", 503);
+  }
+}