fix: harden SAC security per audit (0.4.15)

Close audit findings: anti-spoof client IP for login rate limit, JWT/CORS
enforce on startup, SSH host-key verification and sudo via stdin, optional
WinRM HTTPS, SSE httpOnly cookie auth, ingest body limit, ILIKE escaping,
and HMAC API key hashing with legacy SHA-256 fallback.

backend/app/api/v1/stream.py

@@ -1,13 +1,14 @@
-import asyncio
+import asyncio
 import json
 from datetime import datetime, timedelta, timezone
 
-from fastapi import APIRouter, Depends, Query
+from fastapi import APIRouter, Cookie, Depends, HTTPException
 from fastapi.responses import StreamingResponse
 from sqlalchemy import func, select
 from sqlalchemy.orm import Session
 
 from app.auth.jwt_auth import verify_access_token
+from app.auth.stream_cookie import STREAM_COOKIE_NAME
 from app.database import SessionLocal, get_db
 from app.models import Event, Problem
 from app.config import get_settings
@@ -67,9 +68,12 @@ async def _sse_generator():
 
 
 def _sse_auth(
-    token: str = Query(..., description="JWT access_token"),
+    sac_stream: str | None = Cookie(None, alias=STREAM_COOKIE_NAME),
     db: Session = Depends(get_db),
 ) -> str:
+    token = (sac_stream or "").strip()
+    if not token:
+        raise HTTPException(status_code=401, detail="SSE authentication required")
     return verify_access_token(token, db=db)