fix: harden SAC security per audit (0.4.15)

Close audit findings: anti-spoof client IP for login rate limit, JWT/CORS
enforce on startup, SSH host-key verification and sudo via stdin, optional
WinRM HTTPS, SSE httpOnly cookie auth, ingest body limit, ILIKE escaping,
and HMAC API key hashing with legacy SHA-256 fallback.

backend/app/api/v1/problems.py

@@ -18,6 +18,7 @@ from app.database import get_db
 
 from app.models import Event, Host, Problem, ProblemEvent
 from app.services.event_type_visibility import get_hidden_event_types
+from app.utils.sql_like import escape_ilike_pattern
 
 
 
@@ -193,11 +194,11 @@ def list_problems(
 
     if hostname:
 
-        like = f"%{hostname}%"
+        like = f"%{escape_ilike_pattern(hostname)}%"
 
-        stmt = stmt.where(Host.hostname.ilike(like) | Host.display_name.ilike(like))
+        stmt = stmt.where(Host.hostname.ilike(like, escape="\\") | Host.display_name.ilike(like, escape="\\"))
 
-        count_stmt = count_stmt.where(Host.hostname.ilike(like) | Host.display_name.ilike(like))
+        count_stmt = count_stmt.where(Host.hostname.ilike(like, escape="\\") | Host.display_name.ilike(like, escape="\\"))
 
     if created_within_hours is not None: