fix: auth + double sending etc

docs/security.md

@@ -5,7 +5,8 @@
 - Passwords hashed with bcrypt (cost 12), at least 8 characters; emails stored lowercased.
 - Sign-in sets two httpOnly, SameSite=Lax cookies (Secure in production): a JWT access token for 15 minutes, and a
   refresh token for 30 days, sent only to `/api/v1/auth`. No script can read either.
-- A refresh token works once: refreshing revokes it and issues a new pair. Signing out revokes it.
+- A refresh token works once: refreshing revokes it and issues a new pair. Signing out revokes it. Changing the
+  password signs out every other session at once. Ended sessions are deleted daily after a week.
 - Every request looks the user up: a deleted user, a changed role or a forced sign-out (`sessionsRevokedAt`) applies at
   once instead of when the access token expires.
 - Sign-in answers the same, in the same time, for an unknown email and a wrong password.
@@ -32,7 +33,7 @@ public by id, a SHA-256 hash that can't be guessed.
 
 - Every body and query is validated with a zod schema; unknown fields are dropped.
 - Helmet headers; CORS only for the dashboard's origin.
-- Rate limits: 10 sign-ins or pairings per minute per client, 100 requests per minute otherwise. Terminal syncs are
-  not limited (they are authenticated by the device token).
+- Rate limits: 10 sign-ins or pairings and 30 refreshes per minute per client, 100 requests per minute otherwise.
+  Terminal syncs are not limited (they are authenticated by the device token).
 - Errors are `{ error: { code, message } }`; internal errors are logged and never shown.
 - The realtime socket authenticates with the session cookie and only carries topic names, never data.