Add audit logging, rate limiting, secret redactor, and backlinks

Implement several security and feature improvements across the backend
and frontend:
- New IP-based rate limiter for authentication endpoints
- New audit logging system for sensitive operations
- New secret redactor to mask sensitive patterns in rendered content
- Configurable token TTL and IGNORED_DIRS via environment variables
- Add backlink index and API endpoint
- Add preview tab support with single/double-click behavior in tree
- Add file backup before write/delete operations

backend/auth/jwt_handler.py

@@ -19,8 +19,8 @@ SECRET_KEY_FILE = Path("data/secret.key")
 REVOKED_TOKENS_FILE = Path("data/revoked_tokens.json")
 
 ALGORITHM = "HS256"
-ACCESS_TOKEN_EXPIRE_SECONDS = 3600      # 1 hour
-REFRESH_TOKEN_EXPIRE_SECONDS = 604800   # 7 days
+ACCESS_TOKEN_EXPIRE_SECONDS = int(os.environ.get("OBSIGATE_ACCESS_TOKEN_TTL", "3600"))       # default 1 hour
+REFRESH_TOKEN_EXPIRE_SECONDS = int(os.environ.get("OBSIGATE_REFRESH_TOKEN_TTL", "604800"))   # default 7 days
 
 # In-memory revoked token set (loaded from disk on startup)
 _revoked_jtis: set = set()

backend/auth/router.py

@@ -19,6 +19,7 @@ from .jwt_handler import (
 )
 from .middleware import require_auth, require_admin, is_auth_enabled
 from .password import verify_password, hash_password
+from backend.ratelimit import is_rate_limited, record_failure as rl_record_failure, record_success as rl_record_success
 
 logger = logging.getLogger("obsigate.auth.router")
 
@@ -105,19 +106,26 @@ async def login(request: LoginRequest, response: Response):
     if not user.get("active"):
         raise HTTPException(403, "Compte désactivé")
 
+    # IP-based rate limiting (10 failures / 15 min per IP)
+    client_ip = request.client.host if request.client else "unknown"
+    if is_rate_limited(client_ip):
+        raise HTTPException(429, "Trop de tentatives depuis cette adresse IP (15min)")
+
     if is_locked(request.username):
         raise HTTPException(429, "Compte temporairement verrouillé (15min)")
 
     if not verify_password(request.password, user["password_hash"]):
         attempts = record_login_failure(request.username)
+        rl_attempts, rl_remaining = rl_record_failure(client_ip)
         remaining = max(0, 5 - attempts)
         detail = "Identifiants invalides"
         if 0 < remaining <= 2:
             detail += f" ({remaining} tentative(s) restante(s))"
         raise HTTPException(401, detail)
 
-    # Success — generate tokens
+    # Success — clear rate limits and generate tokens
     record_login_success(request.username)
+    rl_record_success(client_ip)
 
     access_token = create_access_token(user)
     refresh_token, refresh_jti = create_refresh_token(request.username)