testing 101

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

middleware/rateLimiter.middleware.js

@@ -80,10 +80,11 @@ const sensitiveOpsLimiter = rateLimit({
   message: { status: 'error', message: 'Too many sensitive operations. Please wait 1 hour.' },
 });
 
-/** Admin routes — tighter than global */
+/** Admin routes — per authenticated user, not per IP */
 const adminLimiter = rateLimit({
   windowMs: windowMs15,
   max: 200,
+  keyGenerator: (req) => req.user?.user_id?.toString() ?? req.ip,
   standardHeaders: true,
   legacyHeaders: false,
   store: makeStore('admin'),