fix: address critical security and data integrity issues from cross-audit

- Add expire_time > NOW() filter to findActive() preventing stale subscriptions
- Add express-rate-limit on login endpoints (user: 10/15min, admin: 5/15min)
- Add production guard for default admin credentials
- Fix BLE bindDevice userId encoding (uint32 instead of hexToBytes on numeric)
- Wrap adminCreate in transaction to prevent race condition
- Add settings cache invalidation after admin saves
- Read trial_days from settings instead of hardcoding 7
- Fix double JSON.stringify in commandDao.finish call
- Cancel stale pending bindings before creating new ones
- Reduce token refresh grace period from 3 days to 1 day
- Fix subscribe-success to fetch expiry from server (correct for renewals)
- Add keep-alive name property to DashboardView and SettingsView
- Fix BLE disconnect() to preserve listener registrations across reconnects

server/src/app.js

@@ -1,9 +1,26 @@
 const express = require('express')
+const rateLimit = require('express-rate-limit')
 const { ok, fail } = require('./lib/response')
 const { authMiddleware } = require('./middleware/auth')
 
 const app = express()
 
+// Rate limiting for auth-sensitive endpoints
+const userLoginLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 10,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { code: 2001, message: 'too_many_attempts' }
+})
+const adminLoginLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 5,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { code: 2001, message: 'too_many_attempts' }
+})
+
 app.use(express.json())
 app.use((req, res, next) => {
   res.header('Access-Control-Allow-Origin', '*')
@@ -13,6 +30,9 @@ app.use((req, res, next) => {
   next()
 })
 
+app.use('/api/v1/auth/login', userLoginLimiter)
+app.use('/api/v1/admin/login', adminLoginLimiter)
+
 app.use(authMiddleware)
 
 app.get('/health', (req, res) => res.json(ok({ status: 'ok' })))