fix: harden SAC security per audit (0.4.15)

Close audit findings: anti-spoof client IP for login rate limit, JWT/CORS
enforce on startup, SSH host-key verification and sudo via stdin, optional
WinRM HTTPS, SSE httpOnly cookie auth, ingest body limit, ILIKE escaping,
and HMAC API key hashing with legacy SHA-256 fallback.

backend/app/services/client_ip.py

@@ -0,0 +1,27 @@
+"""Resolve client IP behind reverse proxy (nginx $proxy_add_x_forwarded_for)."""
+
+from __future__ import annotations
+
+from fastapi import Request
+
+
+def client_ip_from_request(request: Request) -> str:
+    """Client IP for rate limiting.
+
+    nginx with ``proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for``
+    appends the real peer address as the *last* hop. Spoofed values in the
+    incoming header therefore cannot replace the actual client IP.
+    """
+    if request.client and request.client.host:
+        direct = request.client.host.strip()
+    else:
+        direct = "unknown"
+
+    forwarded = (request.headers.get("x-forwarded-for") or "").strip()
+    if not forwarded:
+        return direct[:64]
+
+    parts = [part.strip() for part in forwarded.split(",") if part.strip()]
+    if not parts:
+        return direct[:64]
+    return parts[-1][:64]