fix: move body parsers before security middleware

express.json() and express.urlencoded() were after advancedBotProtection,
causing req.body to be undefined and triggering honeypot check errors.

Author: ddrayko

server.js

@@ -73,6 +73,9 @@ app.use((req, res, next) => {
   next();
 });
 
+app.use(express.json({ limit: '1mb' }));
+app.use(express.urlencoded({ extended: false, limit: '1mb' }));
+
 app.use('/api', advancedBotProtection());
 app.use('/api', browserIntegrityCheck());
 app.use('/api', vpnProxyProtection());
@@ -138,9 +141,6 @@ app.use(cors({
   allowedHeaders: ['Content-Type', 'Authorization'],
 }));
 
-app.use(express.json({ limit: '1mb' }));
-app.use(express.urlencoded({ extended: false, limit: '1mb' }));
-
 app.use((req, res, next) => {
   if (req.path.startsWith('/api/') && !['GET', 'POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method)) {
     return res.status(405).json({ error: 'Method not allowed', requestId: req.requestId });