God-router: no nonce + no capability check, nopriv-exposed (whole app surface)

A single catch-all endpoint runs for anonymous users with no security token or permission check, exposing the whole app.

Ajax.php:23 + init.php:1041,1063 (probe action=call&endpoint=seater&do=get_state)