Fix critical issues: router method enforcement, cron localhost guard, rate limiter file-based, entity update_at optional, device race condition, area remove transaction, control scripts static flush

Add PHPUnit test suite: ThinBuilder, RateLimiter, PasswordHash (17 tests, all passing)