fix: add missing Map declarations (loginAttempts, adminLoginAttempts, apiRateLimit, csrfTokens)

Fixed ReferenceError: apiRateLimit is not defined that was causing
internal server errors on all pages. Added 4 missing Map variable
declarations that are used throughout the codebase for rate limiting
and CSRF protection.

chat/server.js

@@ -1565,6 +1565,10 @@ let dodoProductCache = {
   byId: new Map(),
 };
 const userSessions = new Map(); // Track user sessions
+const loginAttempts = new Map(); // { email:ip: { count, windowStart, lockedUntil } }
+const adminLoginAttempts = new Map(); // { ip: { count, windowStart, lockedUntil } }
+const apiRateLimit = new Map(); // { userId: { requests, windowStart } }
+const csrfTokens = new Map(); // { token: { userId, expiresAt } }
 let usersDb = []; // In-memory user database cache
 let invoicesDb = []; // In-memory invoice database cache
 let mailTransport = null;