fix: harden SAC security per audit (0.4.15)

Close audit findings: anti-spoof client IP for login rate limit, JWT/CORS
enforce on startup, SSH host-key verification and sudo via stdin, optional
WinRM HTTPS, SSE httpOnly cookie auth, ingest body limit, ILIKE escaping,
and HMAC API key hashing with legacy SHA-256 fallback.

backend/app/services/winrm_connect.py

@@ -1,4 +1,4 @@
-"""WinRM connectivity test for Windows hosts using domain admin credentials."""
+"""WinRM connectivity test for Windows hosts using domain admin credentials."""
 
 from __future__ import annotations
 
@@ -92,13 +92,20 @@ def _winrm_session(
 
     operation_timeout_sec = max(5, timeout_sec)
     read_timeout_sec = operation_timeout_sec + 15
-    endpoint = f"http://{target}:5985/wsman"
+    settings = get_settings()
+    scheme = "https" if settings.sac_winrm_use_https else "http"
+    port = 5986 if settings.sac_winrm_use_https else 5985
+    endpoint = f"{scheme}://{target}:{port}/wsman"
+    cert_validation = (settings.sac_winrm_server_cert_validation or "validate").strip().lower()
+    if cert_validation not in {"validate", "ignore"}:
+        cert_validation = "validate"
     session = winrm.Session(
         endpoint,
         auth=(user, password),
         transport="ntlm",
         read_timeout_sec=read_timeout_sec,
         operation_timeout_sec=operation_timeout_sec,
+        server_cert_validation=cert_validation,
     )
     return session, winrm
 
@@ -540,7 +547,7 @@ def run_winrm_rdp_monitor_update(
             ok=False,
             message=(
                 f"Failed to download RDP bundle on client: {download.message} "
-                f"(URL: {bundle_url})"
+                "(bundle URL omitted from logs)"
             ),
             target=target,
             stdout="\n\n".join(part.strip() for part in [prep.stdout, download.stdout] if part.strip()),