fix: harden SAC security per audit (0.4.15)

Close audit findings: anti-spoof client IP for login rate limit, JWT/CORS
enforce on startup, SSH host-key verification and sudo via stdin, optional
WinRM HTTPS, SSE httpOnly cookie auth, ingest body limit, ILIKE escaping,
and HMAC API key hashing with legacy SHA-256 fallback.

backend/app/api/v1/events.py

@@ -14,6 +14,7 @@ from app.config import get_settings
 from app.database import get_db
 from app.models import Event, Host
 from app.schemas.list_models import EventDetail, EventListResponse, EventSummary
+from app.utils.sql_like import escape_ilike_pattern
 from app.services.agent_commands import (
     command_response_fields,
     command_to_dict,
@@ -185,9 +186,9 @@ def list_events(
         stmt = stmt.where(Event.host_id == host_id)
         count_stmt = count_stmt.where(Event.host_id == host_id)
     if hostname:
-        like = f"%{hostname}%"
-        stmt = stmt.where(Host.hostname.ilike(like) | Host.display_name.ilike(like))
-        count_stmt = count_stmt.where(Host.hostname.ilike(like) | Host.display_name.ilike(like))
+        like = f"%{escape_ilike_pattern(hostname)}%"
+        stmt = stmt.where(Host.hostname.ilike(like, escape="\\") | Host.display_name.ilike(like, escape="\\"))
+        count_stmt = count_stmt.where(Host.hostname.ilike(like, escape="\\") | Host.display_name.ilike(like, escape="\\"))
     dt_from = _parse_optional_dt(from_time)
     dt_to = _parse_optional_dt(to_time, end_of_day=True)
     if dt_from:
@@ -197,9 +198,9 @@ def list_events(
         stmt = stmt.where(Event.occurred_at <= dt_to)
         count_stmt = count_stmt.where(Event.occurred_at <= dt_to)
     if q:
-        like = f"%{q}%"
-        stmt = stmt.where(Event.summary.ilike(like) | Event.title.ilike(like))
-        count_stmt = count_stmt.where(Event.summary.ilike(like) | Event.title.ilike(like))
+        like = f"%{escape_ilike_pattern(q)}%"
+        stmt = stmt.where(Event.summary.ilike(like, escape="\\") | Event.title.ilike(like, escape="\\"))
+        count_stmt = count_stmt.where(Event.summary.ilike(like, escape="\\") | Event.title.ilike(like, escape="\\"))
 
     total = db.scalar(count_stmt) or 0
     rows = db.scalars(