feat: SAC 0.7.2 security hardening (rate limit, JWT DB check, DOMPurify)

Path traversal fix in SPA fallback, admin-only host delete, login rate limit
with 3 attempts and Telegram alert, JWT validated against active users in DB,
and DOMPurify for agent report HTML.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/api/v1/stream.py

@@ -8,7 +8,7 @@ from sqlalchemy import func, select
 from sqlalchemy.orm import Session
 
 from app.auth.jwt_auth import verify_access_token
-from app.database import SessionLocal
+from app.database import SessionLocal, get_db
 from app.models import Event, Problem
 from app.config import get_settings
 from app.services.host_health import DAILY_REPORT_TYPES, HEARTBEAT_TYPE, count_stale_hosts
@@ -66,8 +66,11 @@ async def _sse_generator():
         return
 
 
-def _sse_auth(token: str = Query(..., description="JWT access_token")) -> str:
-    return verify_access_token(token)
+def _sse_auth(
+    token: str = Query(..., description="JWT access_token"),
+    db: Session = Depends(get_db),
+) -> str:
+    return verify_access_token(token, db=db)
 
 
 @router.get("/events")