Add audit logging, rate limiting, secret redactor, and backlinks

Implement several security and feature improvements across the backend
and frontend:
- New IP-based rate limiter for authentication endpoints
- New audit logging system for sensitive operations
- New secret redactor to mask sensitive patterns in rendered content
- Configurable token TTL and IGNORED_DIRS via environment variables
- Add backlink index and API endpoint
- Add preview tab support with single/double-click behavior in tree
- Add file backup before write/delete operations

backend/auth/router.py

@@ -19,6 +19,7 @@ from .jwt_handler import (
 )
 from .middleware import require_auth, require_admin, is_auth_enabled
 from .password import verify_password, hash_password
+from backend.ratelimit import is_rate_limited, record_failure as rl_record_failure, record_success as rl_record_success
 
 logger = logging.getLogger("obsigate.auth.router")
 
@@ -105,19 +106,26 @@ async def login(request: LoginRequest, response: Response):
     if not user.get("active"):
         raise HTTPException(403, "Compte désactivé")
 
+    # IP-based rate limiting (10 failures / 15 min per IP)
+    client_ip = request.client.host if request.client else "unknown"
+    if is_rate_limited(client_ip):
+        raise HTTPException(429, "Trop de tentatives depuis cette adresse IP (15min)")
+
     if is_locked(request.username):
         raise HTTPException(429, "Compte temporairement verrouillé (15min)")
 
     if not verify_password(request.password, user["password_hash"]):
         attempts = record_login_failure(request.username)
+        rl_attempts, rl_remaining = rl_record_failure(client_ip)
         remaining = max(0, 5 - attempts)
         detail = "Identifiants invalides"
         if 0 < remaining <= 2:
             detail += f" ({remaining} tentative(s) restante(s))"
         raise HTTPException(401, detail)
 
-    # Success — generate tokens
+    # Success — clear rate limits and generate tokens
     record_login_success(request.username)
+    rl_record_success(client_ip)
 
     access_token = create_access_token(user)
     refresh_token, refresh_jti = create_refresh_token(request.username)