Add audit logging, rate limiting, secret redactor, and backlinks

Implement several security and feature improvements across the backend
and frontend:
- New IP-based rate limiter for authentication endpoints
- New audit logging system for sensitive operations
- New secret redactor to mask sensitive patterns in rendered content
- Configurable token TTL and IGNORED_DIRS via environment variables
- Add backlink index and API endpoint
- Add preview tab support with single/double-click behavior in tree
- Add file backup before write/delete operations

frontend/style.css

@@ -5446,6 +5446,15 @@ body.popup-mode .content-area {
   max-width: 150px;
 }
 
+/* Preview tab (single-click) — italic title, slightly muted */
+.tab-item.preview .tab-name {
+  font-style: italic;
+  opacity: 0.75;
+}
+.tab-item.preview {
+  background: var(--bg-hover);
+}
+
 .tab-item .tab-close {
   width: 16px;
   height: 16px;
@@ -5478,3 +5487,76 @@ body.popup-mode .content-area {
   background: var(--accent);
   flex-shrink: 0;
 }
+
+/* ── Backlinks panel ── */
+.backlinks-panel {
+  margin-top: 24px;
+  padding: 12px 16px;
+  background: var(--bg-card, var(--bg-secondary));
+  border-radius: 8px;
+  border: 1px solid var(--border);
+}
+.backlinks-header {
+  font-size: 0.8rem;
+  font-weight: 600;
+  color: var(--text-muted);
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  margin-bottom: 8px;
+  text-transform: uppercase;
+  letter-spacing: 0.5px;
+}
+.backlinks-list {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+}
+.backlink-item {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 6px 8px;
+  border-radius: 4px;
+  cursor: pointer;
+  transition: background 0.15s;
+}
+.backlink-item:hover {
+  background: var(--bg-hover);
+}
+.backlink-vault {
+  font-size: 0.7rem;
+  color: var(--accent);
+  background: var(--accent-bg, rgba(99, 102, 241, 0.1));
+  padding: 1px 6px;
+  border-radius: 3px;
+}
+.backlink-title {
+  font-size: 0.85rem;
+  color: var(--text-primary);
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+/* ── Unsupported file notice ── */
+.unsupported-file {
+  padding: 40px;
+  text-align: center;
+  color: var(--text-muted);
+}
+.unsupported-file i {
+  display: block;
+  margin: 0 auto 12px;
+  opacity: 0.4;
+}
+.unsupported-file .filename {
+  font-weight: 600;
+  color: var(--text-primary);
+  margin-bottom: 8px;
+  word-break: break-all;
+}
+.unsupported-file .btn-action {
+  margin-top: 12px;
+  display: inline-flex;
+}