feat: SAC 0.7.2 security hardening (rate limit, JWT DB check, DOMPurify)

Path traversal fix in SPA fallback, admin-only host delete, login rate limit
with 3 attempts and Telegram alert, JWT validated against active users in DB,
and DOMPurify for agent report HTML.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/env.native.example

@@ -78,4 +78,9 @@ SAC_PRIVILEGE_SPIKE_THRESHOLD=10
 SAC_EVENTS_RETENTION_DAYS=90
 SAC_PROBLEMS_RETENTION_DAYS=180
 
+# UI login: блокировка IP после N неудачных попыток (окно в минутах) + алерт в Telegram
+SAC_LOGIN_MAX_FAILURES=3
+SAC_LOGIN_FAILURE_WINDOW_MINUTES=15
+SAC_LOGIN_ALERT_TELEGRAM=true
+
 CORS_ORIGINS=*