- Frontend now reads auth_pin from /api/state and includes X-Pedal-Auth on all non-GET requests - Fixed test imports after removing module-level BLOCK_SIZE/SAMPLE_RATE constants - Removed rogue test_issue_2_3.py from tracking