Add audit logging, rate limiting, secret redactor, and backlinks

Implement several security and feature improvements across the backend
and frontend:
- New IP-based rate limiter for authentication endpoints
- New audit logging system for sensitive operations
- New secret redactor to mask sensitive patterns in rendered content
- Configurable token TTL and IGNORED_DIRS via environment variables
- Add backlink index and API endpoint
- Add preview tab support with single/double-click behavior in tree
- Add file backup before write/delete operations

backend/watcher.py

@@ -1,5 +1,6 @@
 import asyncio
 import logging
+import os
 import time
 from pathlib import Path
 from typing import Callable, Dict, List, Optional
@@ -12,7 +13,19 @@ from backend.indexer import SUPPORTED_EXTENSIONS
 logger = logging.getLogger("obsigate.watcher")
 
 # Extensions de fichiers surveillées
-IGNORED_DIRS = {'.obsidian', '.trash', '.git', '__pycache__', 'node_modules'}
+# Default ignored directories (can be overridden via OBSIGATE_IGNORED_DIRS env var)
+_DEFAULT_IGNORED_DIRS = {'.obsidian', '.trash', '.git', '__pycache__', 'node_modules', '.obsigate-backup'}
+
+def _load_ignored_dirs() -> set:
+    """Load ignored directories from environment or use defaults."""
+    env_val = os.environ.get("OBSIGATE_IGNORED_DIRS", "")
+    if env_val:
+        custom = set(d.strip() for d in env_val.split(",") if d.strip())
+        logger.info(f"Using custom IGNORED_DIRS: {custom}")
+        return custom
+    return _DEFAULT_IGNORED_DIRS.copy()
+
+IGNORED_DIRS = _load_ignored_dirs()
 
 
 class VaultEventHandler(FileSystemEventHandler):