- db-status endpoint: fallback to config.dbPath when system_config db_path is empty
- test-redis endpoint: handler wasnt async, causing Promise serialization to {} instead of result
- Both endpoint handlers now properly async with await
- AdminDashboard: M() now sends admin_token from localStorage with fetch
- rate-limit: keyGenerator uses req.ip instead of req.socket.remoteAddress
(Express trust proxy reads X-Forwarded-For for real client IP)
- main.ts: moved global rateLimiter after express.static so static files
(JS/CSS/admin page/favicon) are never rate-limited
