fix: harden SAC security per audit (0.4.15)

Close audit findings: anti-spoof client IP for login rate limit, JWT/CORS
enforce on startup, SSH host-key verification and sudo via stdin, optional
WinRM HTTPS, SSE httpOnly cookie auth, ingest body limit, ILIKE escaping,
and HMAC API key hashing with legacy SHA-256 fallback.

backend/tests/test_health.py

@@ -1,9 +1,9 @@
-"""Version and health contract smoke tests (no DB required)."""
+"""Version and health contract smoke tests (no DB required)."""
 
 from app.version import APP_NAME, APP_VERSION, APP_VERSION_LABEL
 
 
 def test_version_constants():
-    assert APP_VERSION == "0.3.6"
+    assert APP_VERSION == "0.4.15"
     assert APP_NAME == "Security Alert Center"
-    assert APP_VERSION_LABEL == "Security Alert Center v.0.3.6"
+    assert APP_VERSION_LABEL == "Security Alert Center v.0.4.15"