Add local login, agent extra log paths, IPv4/IPv6 metrics; remediate security audit findings

This is a large squashed commit covering two batches of prior uncommitted
work plus a full security-audit remediation pass, kept together because
go.mod/go.sum and several shared files (main.go, handler.go) were touched
by both and splitting risked non-building intermediate commits.

Features (built earlier, previously uncommitted):
- Local username/password login for single-tenant deployments with no
  SSO configured (api/localauth, alerting/internal/sessioncheck,
  sentryctl users, web/src/routes/login, metadata migrations 0040/0041).
- Remotely-editable additional log file paths for agents, on top of
  their existing primary source (api/agents, agent/sentry-agent
  extra-file-path diffing, web agent config UI).
- IPv4/IPv6 addresses reported alongside other host system metrics.

Security audit remediation (this pass, all live-verified in production):
- Critical: block ClickHouse SSRF table functions (url/remote/file/s3/...)
  in the raw-SQL query escape hatch.
- High: deny sensitive paths and require Admin to add agent
  extra_file_paths (Editor could previously point an agent at /etc/shadow
  or an SSH key); alerting webhook targets now validate against
  internal/metadata/loopback addresses, both at creation and send time;
  alerting's session middleware now enforces an Editor+ floor on
  mutating requests instead of "any authenticated session"; bumped
  goxmldsig to close a SAML signature-verification bypass (GO-2026-4753).
- Medium: per-IP login rate limiting; security response headers
  (HSTS/CSP/nosniff/X-Frame-Options/Referrer-Policy/Permissions-Policy)
  on web/nginx.conf; a DevCredentialWarnings check in every Go service's
  config loader, logging loudly at startup if a deployment is still on
  docker-compose.yml's literal dev-only credentials; dependency bumps
  (golang.org/x/text, grpc, x/net, quick-xml, h2) across every affected
  Go module and both Rust crates, including a previously-uncovered x/net
  vulnerability in deploy/operator; a new security-scan.yml CI workflow
  running cargo-deny/govulncheck/npm-audit, mirroring the existing
  license-compliance.yml matrix shape.
- Low: removed sentryctl's plaintext --password flag (shell
  history/`ps` exposure) in favor of stdin and a --password-stdin flag
  for reset-password's optional specific-password path; a dummy bcrypt
  comparison closes a login response-time username-enumeration
  side-channel.

metadata/migrations/0040_add_local_login_to_users.sql

@@ -0,0 +1,18 @@
+-- Local username/password login (single-tenant deployments with no
+-- enterprise-auth/SSO configured) -- see api/localauth's package doc
+-- comment. Reuses 0017's users table and 0020's tenant_memberships
+-- rather than a parallel identity model, so a deployment that later
+-- turns on enterprise SSO has one identity graph, not two to reconcile.
+--
+-- email relaxed to nullable: a local user has no SSO identity to hang
+-- an email off of. enterprise/internal/rbacstore.UpsertUserBySSO
+-- already requires a non-empty email in Go before ever inserting, so
+-- this is a no-op for the SSO path.
+ALTER TABLE users
+    ALTER COLUMN email DROP NOT NULL;
+
+ALTER TABLE users
+    ADD COLUMN IF NOT EXISTS username TEXT UNIQUE;
+
+ALTER TABLE users
+    ADD COLUMN IF NOT EXISTS password_hash TEXT;

metadata/migrations/0041_create_local_sessions.sql

@@ -0,0 +1,20 @@
+-- Opaque, revocable session tokens for local login -- only the SHA-256
+-- hash of the token is stored, same posture as 0034's
+-- ingest_credentials: the server never needs the raw value back, only
+-- "does this match." role/tenant_id are a snapshot taken at login, not
+-- a live join to tenant_memberships on every request -- api/localauth's
+-- Authorizer runs on every HTTP request, so this keeps that path to one
+-- indexed lookup. Consequence: a role change doesn't take effect for an
+-- existing session until it's revoked/expires and the user logs in
+-- again -- api/localauth.Store.SetPasswordHash deliberately revokes a
+-- user's sessions for exactly this reason.
+CREATE TABLE IF NOT EXISTS local_sessions
+(
+    id         UUID PRIMARY KEY,
+    user_id    UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    tenant_id  TEXT NOT NULL REFERENCES tenants(id),
+    role       TEXT NOT NULL CHECK (role IN ('viewer', 'editor', 'admin', 'owner')),
+    token_hash TEXT NOT NULL UNIQUE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    expires_at TIMESTAMPTZ NOT NULL
+)