fix: P0/P1 fixes (auth+limit+schema) + project audit docs

src/api/routes/admin.js

@@ -26,15 +26,17 @@ function createAdminRouter({ q }) {
 
   // PATCH /api/v1/companies/:id/limit — установить лимит (admin only)
   router.patch('/companies/:id/limit', apiRequireAdmin, json, async (req, res) => {
-    const limit = parseInt((req.body || {}).limit, 10);
-    if (isNaN(limit) || limit < 0) {
-      return res.status(400).json({ error: 'limit must be non-negative integer' });
+    const rawLimit = (req.body || {}).limit;
+    const isReset = rawLimit === null || rawLimit === undefined;
+    const limit = isReset ? null : parseInt(rawLimit, 10);
+    if (!isReset && (isNaN(limit) || limit < 0)) {
+      return res.status(400).json({ error: 'limit must be non-negative integer or null to reset' });
     }
     try {
       await q.setLimit(req.params.id, limit);
       res.json({ ok: true, limit });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      res.status(e.status || 500).json({ error: e.message });
     }
   });