Fix some issues

app/__init__.py

@@ -8,6 +8,9 @@ from flask_login import LoginManager
 from flask_mail import Mail
 from flask_migrate import Migrate
 from flask_socketio import SocketIO
+from flask_wtf.csrf import CSRFProtect
+from flask_limiter import Limiter
+from flask_limiter.util import get_remote_address
 from config.config import config
 
 db       = SQLAlchemy()
@@ -15,6 +18,13 @@ login_manager= LoginManager()
 mail     = Mail()
 migrate  = Migrate()
 socketio = SocketIO()
+csrf     = CSRFProtect()
+# limiter is a module-level name so blueprints can do `from app import limiter`,
+# but the actual Limiter object is constructed inside create_app() — AFTER
+# gunicorn has called eventlet.monkey_patch() in run.py.  Constructing it here
+# (at import time) creates a threading.RLock before the patch runs, which
+# triggers: "1 RLock(s) were not greened".
+limiter: Limiter = None  # type: ignore[assignment]
 
 
 def create_app(config_name=None):
@@ -32,10 +42,24 @@ def create_app(config_name=None):
     login_manager.init_app(app)
     mail.init_app(app)
     migrate.init_app(app, db)
+    csrf.init_app(app)
+
+    # Limiter is constructed here — NOT at module level — so that
+    # eventlet.monkey_patch() (called in run.py before any imports) has already
+    # replaced threading.RLock with a green-thread-safe version.  Constructing
+    # Limiter at module import time creates a real OS RLock before the patch
+    # runs, which produces: "1 RLock(s) were not greened".
+    global limiter
+    limiter = Limiter(
+        key_func    = get_remote_address,
+        default_limits = [],
+        storage_uri = app.config.get('RATELIMIT_STORAGE_URI'),
+    )
+    limiter.init_app(app)
     socketio.init_app(
         app,
         async_mode        = 'eventlet',
-        cors_allowed_origins = '*',
+        cors_allowed_origins = app.config.get('APP_BASE_URL', ''),
         # Ping settings: server sends a ping every 25s, client has 60s to respond.
         # This ensures dead connections are detected and closed cleanly rather than
         # being torn down by nginx timeouts, which causes [Errno 9] Bad file descriptor.