feat: SAC 0.7.2 security hardening (rate limit, JWT DB check, DOMPurify)

Path traversal fix in SPA fallback, admin-only host delete, login rate limit
with 3 attempts and Telegram alert, JWT validated against active users in DB,
and DOMPurify for agent report HTML.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/config.py

@@ -100,6 +100,11 @@ class Settings(BaseSettings):
     sac_events_retention_days: int = 90
     sac_problems_retention_days: int = 180
 
+    # UI login brute-force protection
+    sac_login_max_failures: int = 3
+    sac_login_failure_window_minutes: int = 15
+    sac_login_alert_telegram: bool = True
+
 
 @lru_cache
 def get_settings() -> Settings: