feat: ingest burst hardening — defer lifecycle/auth, workers, nginx (v0.5.5)

Defer notify_lifecycle and notify_auth_login after commit; SAC_UVICORN_WORKERS via sac-api-start.sh; nginx /api/v1/events timeout; mass-update confirm in Hosts UI.

deploy/systemd/sac-api-start.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Uvicorn launcher: SAC_UVICORN_WORKERS из sac-api.env (без systemd EnvironmentFile).
+set -euo pipefail
+
+APP_ROOT="${SAC_APP_ROOT:-/opt/security-alert-center}"
+CONFIG_FILE="${SAC_CONFIG_FILE:-${APP_ROOT}/config/sac-api.env}"
+VENV="${APP_ROOT}/backend/.venv"
+HOST="127.0.0.1"
+PORT="8000"
+WORKERS=4
+
+_read_env_int() {
+	local key="$1" default="$2" line val
+	[ -f "$CONFIG_FILE" ] || {
+		printf '%s\n' "$default"
+		return 0
+	}
+	line="$(grep -E "^[[:space:]]*${key}=" "$CONFIG_FILE" 2>/dev/null | tail -1)" || {
+		printf '%s\n' "$default"
+		return 0
+	}
+	val="${line#*=}"
+	val="${val#"${val%%[![:space:]]*}"}"
+	val="${val%"${val##*[![:space:]]}"}"
+	val="${val#\"}"
+	val="${val%\"}"
+	val="${val#\'}"
+	val="${val%\'}"
+	if [[ "$val" =~ ^[0-9]+$ ]] && [ "$val" -ge 1 ]; then
+		printf '%s\n' "$val"
+	else
+		printf '%s\n' "$default"
+	fi
+}
+
+WORKERS="$(_read_env_int SAC_UVICORN_WORKERS 4)"
+
+exec "${VENV}/bin/uvicorn" app.main:app \
+	--host "$HOST" \
+	--port "$PORT" \
+	--workers "$WORKERS" \
+	--timeout-graceful-shutdown 30

deploy/systemd/sac-api.service

@@ -13,7 +13,7 @@ WorkingDirectory=/opt/security-alert-center/backend
 # Конфиг читает само приложение (pydantic), не systemd — иначе ломаются пароли с #, $ и т.д.
 Environment=SAC_CONFIG_FILE=/opt/security-alert-center/config/sac-api.env
 Environment=PYTHONPATH=/opt/security-alert-center/backend
-ExecStart=/opt/security-alert-center/backend/.venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 8000 --workers 2 --timeout-graceful-shutdown 30
+ExecStart=/opt/security-alert-center/deploy/systemd/sac-api-start.sh
 Restart=on-failure
 RestartSec=5
 TimeoutStopSec=20