Update README and configuration to replace RSA with Ed25519 for federation security

server/routes/admin.js

@@ -102,6 +102,11 @@ router.put('/users/:id/role', authenticateToken, requireAdmin, async (req, res)
     await db.run('UPDATE users SET role = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?', [role, req.params.id]);
     const updated = await db.get('SELECT id, name, email, role, created_at FROM users WHERE id = ?', [req.params.id]);
 
+    // S7: verify user actually exists
+    if (!updated) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+
     res.json({ user: updated });
   } catch (err) {
     console.error('Update role error:', err);