fix(security): consolidation & securite phase 1 (#84, BUG-021 a BUG-034)

- sanitizer XSS serveur (markdown + page de partage) [BUG-021/022]
- rate-limit/lockout MFA [BUG-023]
- isolation vaults par segments [BUG-024]
- caps regex ReDoS [BUG-025]
- SSRF webhooks + secrets externalises [BUG-026]
- rotation/revocation des jetons [BUG-027]
- politique de mot de passe + invalidation sessions [BUG-028]
- verrous users.json [BUG-029]
- IP reelle dans les audits [BUG-030]
- rate-limit par compte [BUG-031]
- symlinks hors vault ignores [BUG-032]
- recherche simple via inverted index [BUG-033]
- token en memoire + cookie HttpOnly, CSP durcie [BUG-034]

Tests: pytest 961 passed / 6 skipped, ruff 0, mypy 0, frontend vert.

backend/auth/jwt_handler.py

@@ -62,16 +62,21 @@ def create_access_token(user: dict) -> str:
     return jwt.encode(payload, get_secret_key(), algorithm=ALGORITHM)
 
 
-def create_refresh_token(username: str) -> tuple:
-    """Create a JWT refresh token. Returns (token_string, jti)."""
+def create_refresh_token(username: str, remember: bool = False) -> tuple:
+    """Create a JWT refresh token. Returns (token_string, jti).
+
+    ``remember`` is carried as a claim so token rotation can preserve the
+    30-day vs 7-day lifetime chosen at login.
+    """
     now = int(time.time())
     jti = str(uuid.uuid4())
     payload = {
         "sub": username,
         "jti": jti,
         "iat": now,
-        "exp": now + REFRESH_TOKEN_EXPIRE_SECONDS,
+        "exp": now + (2592000 if remember else REFRESH_TOKEN_EXPIRE_SECONDS),
         "type": "refresh",
+        "remember": remember,
     }
     return jwt.encode(payload, get_secret_key(), algorithm=ALGORITHM), jti