Fix critical issues: router method enforcement, cron localhost guard, rate limiter file-based, entity update_at optional, device race condition, area remove transaction, control scripts static flush

Phase 3: API hardening (validation, JSON wrappers, path traversal, rate limiting)