Warn at startup when limits are on without trusted_proxies, and once when a
request carries forwarding headers Beacon ignores. Reject short or whitespace
admin keys and negative durations. Key default-window stats by hour, return
500 for scope lookup failures, and validate IATA path params.
* feat(admin): update runtime CORS origins consistently
* test(admin): preserve rate-limit headers after CORS updates
* test(admin): preserve router connection budget after rebase
MrAlders0n