fix: address critical security and data integrity issues from cross-audit

- Add expire_time > NOW() filter to findActive() preventing stale subscriptions
- Add express-rate-limit on login endpoints (user: 10/15min, admin: 5/15min)
- Add production guard for default admin credentials
- Fix BLE bindDevice userId encoding (uint32 instead of hexToBytes on numeric)
- Wrap adminCreate in transaction to prevent race condition
- Add settings cache invalidation after admin saves
- Read trial_days from settings instead of hardcoding 7
- Fix double JSON.stringify in commandDao.finish call
- Cancel stale pending bindings before creating new ones
- Reduce token refresh grace period from 3 days to 1 day
- Fix subscribe-success to fetch expiry from server (correct for renewals)
- Add keep-alive name property to DashboardView and SettingsView
- Fix BLE disconnect() to preserve listener registrations across reconnects

server/src/routes/admin.js

@@ -2,6 +2,7 @@ const router = require('express').Router()
 const { ok, fail } = require('../lib/response')
 const { hashPassword, hashPasswordLegacy, verifyPassword, signAdmin } = require('../lib/auth')
 const { requireAdmin } = require('../middleware/auth')
+const { invalidateCache } = require('../lib/settings-cache')
 const adminDao = require('../dao/admin.dao')
 const deviceDao = require('../dao/device.dao')
 const bindingDao = require('../dao/binding.dao')
@@ -229,6 +230,7 @@ router.post('/settings', requireAdmin, wrap(async (req, res) => {
     if (!ALLOWED_KEYS.includes(key)) continue
     await settingsDao.update(key, req.body[key])
   }
+  invalidateCache()
   res.json(ok({ message: 'success' }))
 }))