CodeQL false positive: js/missing-rate-limiting on admin routes with custom middleware #691

Summary

CodeQL flags js/missing-rate-limiting (High) on authenticated admin routes that already use our custom Redis-backed rate limiter. This blocks otherwise correct admin PRs in CI.

Affected PRs

• feat: add admin backend foundation (login, session, health) #641 — Phase 1 admin auth (/login, /session, /health) — merged; same pattern
• feat(admin): add Prometheus-backed /admin/metrics SSE endpoint #662 — /admin/metrics SSE — merged; same pattern
• feat(admin): add authenticated settings API endpoints #690 — settings API (PATCH /admin/settings, POST /admin/settings/validate) — currently failing CI

Example (#690)

router.patch('/settings', adminRateLimitMiddleware, adminAuthMiddleware, json(), ...)
router.post('/settings/validate', adminRateLimitMiddleware, adminAuthMiddleware, ...)

Both routes include adminRateLimitMiddleware before auth. CodeQL still reports missing rate limiting.

Proposed fix

CodeQL config to recognize adminRateLimitMiddleware as a rate limiter