fix: harden SAC security per audit (0.4.15)

Close audit findings: anti-spoof client IP for login rate limit, JWT/CORS
enforce on startup, SSH host-key verification and sudo via stdin, optional
WinRM HTTPS, SSE httpOnly cookie auth, ingest body limit, ILIKE escaping,
and HMAC API key hashing with legacy SHA-256 fallback.

backend/tests/test_ingest_body_limit.py

@@ -0,0 +1,23 @@
+"""Ingest body size limit middleware."""
+
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+from app.middleware.ingest_body_limit import IngestBodySizeLimitMiddleware
+
+
+def test_ingest_body_size_limit_rejects_large_content_length():
+    app = FastAPI()
+    app.add_middleware(IngestBodySizeLimitMiddleware, max_bytes=128)
+
+    @app.post("/api/v1/events")
+    def ingest():
+        return {"ok": True}
+
+    client = TestClient(app)
+    response = client.post(
+        "/api/v1/events",
+        content=b"x" * 10,
+        headers={"content-length": "256"},
+    )
+    assert response.status_code == 413