fix: harden SAC security per audit (0.4.15)

Close audit findings: anti-spoof client IP for login rate limit, JWT/CORS
enforce on startup, SSH host-key verification and sudo via stdin, optional
WinRM HTTPS, SSE httpOnly cookie auth, ingest body limit, ILIKE escaping,
and HMAC API key hashing with legacy SHA-256 fallback.

backend/app/config.py

@@ -1,4 +1,4 @@
-import os
+import os
 from functools import lru_cache
 from pathlib import Path
 
@@ -42,6 +42,9 @@ class Settings(BaseSettings):
     jwt_secret: str = "change-me-in-production"
     jwt_algorithm: str = "HS256"
     jwt_expire_minutes: int = 60 * 24
+    # Fail-fast on weak JWT/CORS defaults (disable only for local dev/tests).
+    sac_security_enforce: bool = True
+    sac_ingest_max_body_bytes: int = 2_097_152
 
     sac_bootstrap_api_key: str = ""
     sac_admin_username: str = "admin"
@@ -116,10 +119,14 @@ class Settings(BaseSettings):
     # Windows admin for agent qwinsta/logoff (domain-wide)
     sac_win_admin_user: str = ""
     sac_win_admin_password: str = ""
+    sac_winrm_use_https: bool = False
+    sac_winrm_server_cert_validation: str = "validate"
 
     # Linux SSH admin for remote agent update (fallback SSH, phase 5)
     sac_linux_admin_user: str = ""
     sac_linux_admin_password: str = ""
+    sac_ssh_known_hosts_file: str = "/opt/security-alert-center/config/ssh_known_hosts"
+    sac_ssh_auto_add_host_key: bool = False
 
     # Agent updates (mode gpo|sac, recommended versions, WinRM fallback script)
     sac_agent_update_mode: str = "gpo"