Fix live-query updates under result-cache pressure, keep project lookup indexed, and aggregate dashboard metrics without constructing full chart series. Add explicit bounded live-connection and password-hash admission settings while preserving defaults and password strength. Verified by 819 tests, Node 22 and 24 CI, packaged-release conformance, and CodeQL. The attached package is independently attested by the release workflow.