fix: harden SAC security per audit (0.4.15)

Close audit findings: anti-spoof client IP for login rate limit, JWT/CORS
enforce on startup, SSH host-key verification and sudo via stdin, optional
WinRM HTTPS, SSE httpOnly cookie auth, ingest body limit, ILIKE escaping,
and HMAC API key hashing with legacy SHA-256 fallback.

deploy/env.native.example

@@ -1,4 +1,4 @@
-# Native: /opt/security-alert-center/config/sac-api.env
+# Native: /opt/security-alert-center/config/sac-api.env
 # sudo chown sac:sac ... && sudo chmod 600 ...
 # Пароль в URL — в двойных кавычках. Символ # в пароле допустим только внутри кавычек.
 # systemd НЕ парсит этот файл — читает приложение (SAC_CONFIG_FILE).
@@ -12,6 +12,7 @@ SAC_PUBLIC_URL=https://sac.kalinamall.ru
 # Опционально: другой базовый URL для WinRM-скачивания RDP bundle с ПК (LAN / split-DNS).
 # SAC_AGENT_BUNDLE_BASE_URL=https://192.168.x.x
 JWT_SECRET=CHANGE_ME_openssl_rand_hex_32
+SAC_SECURITY_ENFORCE=true
 
 # API key для агентов: Authorization: Bearer <ключ>
 # python3.12 -c "import secrets; print('sac_'+secrets.token_urlsafe(32))"
@@ -124,4 +125,12 @@ SAC_FCM_PROJECT_ID=
 SAC_FCM_SERVICE_ACCOUNT_JSON=
 SAC_MOBILE_REFRESH_EXPIRE_DAYS=90
 
-CORS_ORIGINS=*
+CORS_ORIGINS=https://sac.kalinamall.ru
+
+# SSH: verify host keys (RejectPolicy). Add keys to file before remote actions.
+# SAC_SSH_KNOWN_HOSTS_FILE=/opt/security-alert-center/config/ssh_known_hosts
+# SAC_SSH_AUTO_ADD_HOST_KEY=false
+
+# WinRM: enable HTTPS listener on clients (5986) before turning on.
+# SAC_WINRM_USE_HTTPS=false
+# SAC_WINRM_SERVER_CERT_VALIDATION=validate