fix(security): consolidation & securite phase 1 (#84, BUG-021 a BUG-034)

- sanitizer XSS serveur (markdown + page de partage) [BUG-021/022]
- rate-limit/lockout MFA [BUG-023]
- isolation vaults par segments [BUG-024]
- caps regex ReDoS [BUG-025]
- SSRF webhooks + secrets externalises [BUG-026]
- rotation/revocation des jetons [BUG-027]
- politique de mot de passe + invalidation sessions [BUG-028]
- verrous users.json [BUG-029]
- IP reelle dans les audits [BUG-030]
- rate-limit par compte [BUG-031]
- symlinks hors vault ignores [BUG-032]
- recherche simple via inverted index [BUG-033]
- token en memoire + cookie HttpOnly, CSP durcie [BUG-034]

Tests: pytest 961 passed / 6 skipped, ruff 0, mypy 0, frontend vert.

backend/auth/middleware.py

@@ -8,7 +8,9 @@ import os
 from fastapi import Depends, HTTPException, Request
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 
-from .jwt_handler import decode_token
+from backend.services.net import get_client_ip
+
+from .jwt_handler import decode_token, is_token_revoked
 from .user_store import get_user
 
 logger = logging.getLogger("obsigate.auth.middleware")
@@ -42,6 +44,7 @@ def get_current_user(
             "vaults": ["*"],
             "active": True,
             "_token_vaults": ["*"],
+            "_request_ip": get_client_ip(request),
         }
 
     token = None
@@ -57,14 +60,31 @@ def get_current_user(
     if not payload or payload.get("type") != "access":
         return None
 
+    # BUG-027: access tokens revoked at logout must be rejected immediately.
+    jti = payload.get("jti")
+    if jti and is_token_revoked(jti):
+        return None
+
     user = get_user(payload["sub"])
     if not user or not user.get("active"):
         return None
 
+    # BUG-028: a password change invalidates every token issued before it.
+    pca = user.get("password_changed_at")
+    iat = payload.get("iat")
+    if pca is not None and iat is not None:
+        try:
+            if int(iat) < int(float(pca)):
+                return None
+        except (TypeError, ValueError):
+            return None
+
     # Attach vault permissions from the token (snapshot at login time)
     user["_token_vaults"] = payload.get("vaults", [])
     # Attach the token id for per-token rate limiting (AI tool layer).
     user["_token_jti"] = payload.get("jti")
+    # BUG-030: expose the real client IP to the audit log.
+    user["_request_ip"] = get_client_ip(request)
     return user