- Fixed a hard FCM 500-token multicast limit by chunking every send.
- Locked down CORS to the real dashboard origins and added rate limiting to public SDK endpoints.
- Added Firestore-backed scheduler locks so multiple backend instances can never double-fire the same scheduled job.
- Moved large broadcasts to an async background path so sends no longer risk an HTTP timeout.