fix: auth + double sending etc

docs/architecture.md

@@ -25,7 +25,7 @@ products); terminals see that on their next sync. See [terminal-protocol.md](ter
 | `terminal/` | Pairing, sync and picture uploads for terminals; device token auth; the minimum app version |
 | `auth/` | Dashboard sign-in with httpOnly cookies, refresh token rotation, `GET /auth/me` |
 | `tabs/`, `customers/`, `stock/`, `reminders/`, `venues/` | The dashboard API, one module per page |
-| `admin/` | The superadmin page: venues, terminals, users, resets, consistency checks, purges |
+| `admin/` | The superadmin page: venues, terminals, users, resets, consistency checks, purges; daily housekeeping |
 | `realtime/` | Socket.IO: tells dashboards which data changed (topics only, never data) |
 | `email/` | Templates in `templates/emails` and Resend |
 | `images/` | Product pictures, processed with sharp and stored on disk by content hash |

docs/security.md

@@ -5,7 +5,8 @@
 - Passwords hashed with bcrypt (cost 12), at least 8 characters; emails stored lowercased.
 - Sign-in sets two httpOnly, SameSite=Lax cookies (Secure in production): a JWT access token for 15 minutes, and a
   refresh token for 30 days, sent only to `/api/v1/auth`. No script can read either.
-- A refresh token works once: refreshing revokes it and issues a new pair. Signing out revokes it.
+- A refresh token works once: refreshing revokes it and issues a new pair. Signing out revokes it. Changing the
+  password signs out every other session at once. Ended sessions are deleted daily after a week.
 - Every request looks the user up: a deleted user, a changed role or a forced sign-out (`sessionsRevokedAt`) applies at
   once instead of when the access token expires.
 - Sign-in answers the same, in the same time, for an unknown email and a wrong password.
@@ -32,7 +33,7 @@ public by id, a SHA-256 hash that can't be guessed.
 
 - Every body and query is validated with a zod schema; unknown fields are dropped.
 - Helmet headers; CORS only for the dashboard's origin.
-- Rate limits: 10 sign-ins or pairings per minute per client, 100 requests per minute otherwise. Terminal syncs are
-  not limited (they are authenticated by the device token).
+- Rate limits: 10 sign-ins or pairings and 30 refreshes per minute per client, 100 requests per minute otherwise.
+  Terminal syncs are not limited (they are authenticated by the device token).
 - Errors are `{ error: { code, message } }`; internal errors are logged and never shown.
 - The realtime socket authenticates with the session cookie and only carries topic names, never data.