fix: harden SAC security per audit (0.4.15)

Close audit findings: anti-spoof client IP for login rate limit, JWT/CORS
enforce on startup, SSH host-key verification and sudo via stdin, optional
WinRM HTTPS, SSE httpOnly cookie auth, ingest body limit, ILIKE escaping,
and HMAC API key hashing with legacy SHA-256 fallback.

backend/tests/conftest.py

@@ -1,10 +1,14 @@
-"""SQLite in-memory fixtures for API tests."""
+"""SQLite in-memory fixtures for API tests."""
 
 import os
 
 # Must be set before app.database imports create_engine
 os.environ.setdefault("DATABASE_URL", "sqlite:///:memory:")
 os.environ.setdefault("SAC_BOOTSTRAP_API_KEY", "sac_test_key_for_pytest_only")
+os.environ.setdefault("SAC_SECURITY_ENFORCE", "false")
+os.environ.setdefault("JWT_SECRET", "pytest-jwt-secret-not-for-production-use")
+os.environ.setdefault("SAC_SSH_AUTO_ADD_HOST_KEY", "true")
+os.environ.setdefault("SAC_HOST_SILENCE_SCAN_ENABLED", "false")
 
 import pytest
 from fastapi.testclient import TestClient
@@ -120,6 +124,7 @@ def client(db_session, db_engine, monkeypatch):
     monkeypatch.setenv("SAC_REMOTE_ACTION_INLINE", "1")
     monkeypatch.setattr("app.main.bootstrap_api_key", lambda: None)
     monkeypatch.setattr("app.main.bootstrap_users", lambda: None)
+    monkeypatch.setattr("app.main.bootstrap_stale_remote_actions", lambda: None)
 
     test_session_local = sessionmaker(bind=db_engine, autocommit=False, autoflush=False)
     monkeypatch.setattr("app.services.host_remote_actions.SessionLocal", test_session_local)