Security hardening

Beyond the defaults, two endpoints are worth an explicit rate-limit rule in production because they’re meaningfully more expensive than an ordinary record read: POST /api/sql (the dashboard SQL console — superuser-only already, but a single query can hold a connection for seconds) and POST /api/llm/chat (spends the operator’s own provider quota per call). See Rate limiting for the exact rule shape. Beyond that: the audit log covers schema/settings/superuser changes, superuser roles separate owner from admin, and rotating AUTH_SECRET invalidates every session at once if a secret is ever suspected compromised.