feat: SAC 0.7.2 security hardening (rate limit, JWT DB check, DOMPurify)

Path traversal fix in SPA fallback, admin-only host delete, login rate limit
with 3 attempts and Telegram alert, JWT validated against active users in DB,
and DOMPurify for agent report HTML.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/main.py

@@ -105,9 +105,15 @@ def create_app() -> FastAPI:
         def spa_fallback(spa_path: str) -> FileResponse:
             if spa_path.startswith("api/"):
                 raise HTTPException(status_code=404, detail="Not Found")
-            candidate = frontend_dist / spa_path
-            if spa_path and candidate.is_file():
-                return FileResponse(candidate)
+            dist_root = frontend_dist.resolve()
+            if spa_path:
+                candidate = (frontend_dist / spa_path).resolve()
+                try:
+                    candidate.relative_to(dist_root)
+                except ValueError:
+                    raise HTTPException(status_code=404, detail="Not Found") from None
+                if candidate.is_file():
+                    return FileResponse(candidate)
             index = frontend_dist / "index.html"
             if not index.is_file():
                 raise HTTPException(status_code=404, detail="UI not built")