[grade=pending] QA sprint: commit 103 at-risk files from multi-agent sprint work

Committed by Hermes autonomous QA sprint 2026-08-13.
These files were modified during the Aug 12 sprint but never committed.

dashcaddy-api/routes/license.js

@@ -1,7 +1,20 @@
 const express = require('express');
+const rateLimit = require('express-rate-limit');
 const { success, error: errorResponse } = require('../src/utils/responses');
 const { ValidationError } = require('../src/utilities/errors');
 
+// Dedicated rate limiter for license activation — prevents brute-force key guessing.
+// Pro keys follow a predictable format (DC-XXX-XXXXX-XXXXXX), so without rate
+// limiting an attacker could enumerate valid keys.
+const licenseActivateLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 10,                   // 10 attempts per window per IP
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { success: false, error: 'Too many license activation attempts. Please try again later.' },
+  skip: () => process.env.NODE_ENV === 'test',
+});
+
 /**
  * License routes factory
  * @param {Object} deps - Explicit dependencies
@@ -13,7 +26,7 @@ module.exports = function({ licenseManager, asyncHandler }) {
   const router = express.Router();
 
   // Activate a license code
-  router.post('/activate', asyncHandler(async (req, res) => {
+  router.post('/activate', licenseActivateLimiter, asyncHandler(async (req, res) => {
     const { code } = req.body;
     if (!code) {
       throw new ValidationError('License code is required');