feat: SAC 0.7.2 security hardening (rate limit, JWT DB check, DOMPurify)

Path traversal fix in SPA fallback, admin-only host delete, login rate limit
with 3 attempts and Telegram alert, JWT validated against active users in DB,
and DOMPurify for agent report HTML.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_hosts.py

@@ -77,6 +77,21 @@ def test_delete_host_404(client, jwt_headers):
     assert r.status_code == 404
 
 
+def test_delete_host_forbidden_for_monitor(client, db_session, jwt_monitor_headers):
+    h = Host(
+        hostname="monitor-blocked",
+        os_family="linux",
+        product="ssh-monitor",
+        last_seen_at=datetime.now(timezone.utc),
+    )
+    db_session.add(h)
+    db_session.commit()
+
+    r = client.delete(f"/api/v1/hosts/{h.id}", headers=jwt_monitor_headers)
+    assert r.status_code == 403
+    assert db_session.get(Host, h.id) is not None
+
+
 def test_delete_host_requires_jwt(client, db_session):
     h = Host(
         hostname="no-auth",