fix: harden SAC security per audit (0.4.15)

Close audit findings: anti-spoof client IP for login rate limit, JWT/CORS
enforce on startup, SSH host-key verification and sudo via stdin, optional
WinRM HTTPS, SSE httpOnly cookie auth, ingest body limit, ILIKE escaping,
and HMAC API key hashing with legacy SHA-256 fallback.

backend/app/utils/sql_like.py

@@ -0,0 +1,8 @@
+"""Escape user input for SQL ILIKE patterns."""
+
+
+def escape_ilike_pattern(value: str) -> str:
+    text = (value or "").strip()
+    if not text:
+        return text
+    return text.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")