fix: harden SAC security per audit (0.4.15)

Close audit findings: anti-spoof client IP for login rate limit, JWT/CORS
enforce on startup, SSH host-key verification and sudo via stdin, optional
WinRM HTTPS, SSE httpOnly cookie auth, ingest body limit, ILIKE escaping,
and HMAC API key hashing with legacy SHA-256 fallback.

backend/app/api/v1/hosts.py

@@ -12,6 +12,7 @@ from app.config import get_settings
 from app.database import get_db
 from app.models import Event, Host
 from app.schemas.list_models import HostDetail, HostListResponse, HostSummary
+from app.utils.sql_like import escape_ilike_pattern
 from app.services.agent_version import (
     latest_agent_versions_by_product,
     reference_agent_versions_by_product,
@@ -101,8 +102,8 @@ def list_hosts(
         stmt = stmt.where(Host.product == product)
         count_stmt = count_stmt.where(Host.product == product)
     if hostname:
-        like = f"%{hostname}%"
-        host_match = Host.hostname.ilike(like) | Host.display_name.ilike(like)
+        like = f"%{escape_ilike_pattern(hostname)}%"
+        host_match = Host.hostname.ilike(like, escape="\\") | Host.display_name.ilike(like, escape="\\")
         stmt = stmt.where(host_match)
         count_stmt = count_stmt.where(host_match)