security: high-severity fixes (api throttle, fillable, idor, path, rel)

- Add 60 req/min throttle to the public API group and a stricter 10 req/min
  throttle to POST /highscores.
- Replace mass-assigned $guarded=[] with explicit $fillable on User, Meetup,
  Course, Lecturer, and SelfHostedService. created_by stays out of the
  whitelist; the existing creating() hooks continue to populate it.
- Require authenticated user on Api/MeetupController::index instead of
  trusting the user_id query parameter (IDOR).
- Constrain the /img and /img-public route paths to a safe character set
  and reject any path containing ".." in ImageController.
- Add rel="noopener noreferrer" to every target="_blank" link on the meetup
  and course landing pages.

app/Http/Controllers/Api/MeetupController.php

@@ -4,7 +4,6 @@ namespace App\Http\Controllers\Api;
 
 use App\Http\Controllers\Controller;
 use App\Models\Meetup;
-use App\Models\User;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Http\Request;
 
@@ -17,14 +16,10 @@ class MeetupController extends Controller
 
     public function index(Request $request)
     {
-        if (!is_numeric($request->input('user_id'))) {
-            abort(404);
-        }
+        $user = $request->user();
+        abort_unless($user, 401);
 
-        $myMeetupIds = User::query()
-            ->findOrFail($request->input('user_id'))
-            ?->meetups
-            ->pluck('id');
+        $myMeetupIds = $user->meetups->pluck('id');
 
         return Meetup::query()
             ->select('id', 'name', 'city_id', 'slug')