Fix/json body limit and jwt exp validation

backend/src/app.ts

@@ -72,7 +72,7 @@ app.use((err: unknown, req: Request, res: Response, next: NextFunction) => {
     }
     next(err);
 });
-app.use(express.json());
+app.use(express.json({ limit: '1mb' }));
 
 // Sandbox mode detection (before versioning)
 app.use(sandboxMiddleware);

backend/src/middleware/auth.ts

@@ -104,7 +104,7 @@ export function verifyJwt(token: string): { publicKey: string } | null {
       .digest();
     if (!crypto.timingSafeEqual(Buffer.from(sig, 'base64url'), expected)) return null;
     const payload = JSON.parse(Buffer.from(body, 'base64url').toString());
-    if (payload.exp < Math.floor(Date.now() / 1000)) return null;
+    if (typeof payload.exp !== 'number' || payload.exp < Math.floor(Date.now() / 1000)) return null;
     return { publicKey: payload.sub };
   } catch {
     return null;

frontend/src/hooks/useStreamEvents.ts

@@ -28,6 +28,7 @@ export function useStreamEvents(
 ): UseStreamEventsReturn {
   const {
     streamIds = [],
+    // userPublicKeys = [],
     subscribeToAll = false,
     autoReconnect = true,
     maxRetryDelay = 30000,