Add local login, agent extra log paths, IPv4/IPv6 metrics; remediate security audit findings

This is a large squashed commit covering two batches of prior uncommitted
work plus a full security-audit remediation pass, kept together because
go.mod/go.sum and several shared files (main.go, handler.go) were touched
by both and splitting risked non-building intermediate commits.

Features (built earlier, previously uncommitted):
- Local username/password login for single-tenant deployments with no
  SSO configured (api/localauth, alerting/internal/sessioncheck,
  sentryctl users, web/src/routes/login, metadata migrations 0040/0041).
- Remotely-editable additional log file paths for agents, on top of
  their existing primary source (api/agents, agent/sentry-agent
  extra-file-path diffing, web agent config UI).
- IPv4/IPv6 addresses reported alongside other host system metrics.

Security audit remediation (this pass, all live-verified in production):
- Critical: block ClickHouse SSRF table functions (url/remote/file/s3/...)
  in the raw-SQL query escape hatch.
- High: deny sensitive paths and require Admin to add agent
  extra_file_paths (Editor could previously point an agent at /etc/shadow
  or an SSH key); alerting webhook targets now validate against
  internal/metadata/loopback addresses, both at creation and send time;
  alerting's session middleware now enforces an Editor+ floor on
  mutating requests instead of "any authenticated session"; bumped
  goxmldsig to close a SAML signature-verification bypass (GO-2026-4753).
- Medium: per-IP login rate limiting; security response headers
  (HSTS/CSP/nosniff/X-Frame-Options/Referrer-Policy/Permissions-Policy)
  on web/nginx.conf; a DevCredentialWarnings check in every Go service's
  config loader, logging loudly at startup if a deployment is still on
  docker-compose.yml's literal dev-only credentials; dependency bumps
  (golang.org/x/text, grpc, x/net, quick-xml, h2) across every affected
  Go module and both Rust crates, including a previously-uncovered x/net
  vulnerability in deploy/operator; a new security-scan.yml CI workflow
  running cargo-deny/govulncheck/npm-audit, mirroring the existing
  license-compliance.yml matrix shape.
- Low: removed sentryctl's plaintext --password flag (shell
  history/`ps` exposure) in favor of stdin and a --password-stdin flag
  for reset-password's optional specific-password path; a dummy bcrypt
  comparison closes a login response-time username-enumeration
  side-channel.

web/nginx.conf

@@ -3,6 +3,43 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
+    # Security-audit remediation (M-3): baseline browser security headers,
+    # absent entirely before this. HSTS/nosniff/frame-options/referrer-
+    # policy/permissions-policy carry no functional risk to this app and
+    # are unconditionally safe to add.
+    #
+    # CSP is the one directive that needed real care rather than a
+    # copy-pasted strict default: adapter-static's own build output
+    # (web/build/index.html) genuinely contains two inline <script>
+    # blocks -- SvelteKit's own hydration bootstrap and the dark-mode-
+    # before-paint snippet -- so a naive `script-src 'self'` would break
+    # every page load, not just XSS. Hash-pinning those two scripts
+    # instead was considered and rejected: nginx.conf is a static file
+    # this Docker image ships unmodified, with nothing in the build
+    # pipeline that regenerates it per build, and SvelteKit's bootstrap
+    # script embeds a build-specific identifier -- a hardcoded hash here
+    # would silently start blocking the app's own hydration script on the
+    # next unrelated rebuild, a far worse outcome than the gap this is
+    # closing. `script-src`/`style-src` therefore keep `'unsafe-inline'`
+    # (inline style attributes are also genuinely used, e.g. the Hosts
+    # page's dynamic bar-width styling) -- this CSP is not a script-
+    # injection defense by itself (the codebase already has no known XSS
+    # vector to defend against -- see the security audit's "verified
+    # clean" section), it's the other directives doing real work:
+    # `object-src none` (no plugin-embed vector), `frame-ancestors none`
+    # (clickjacking, redundant with X-Frame-Options but cheap insurance),
+    # `base-uri self` (blocks base-tag hijacking), `form-action self`.
+    # `connect-src *` stays permissive rather than enumerating this
+    # deployment's actual api/alerting/enterprise-auth hosts, since those
+    # are configured per-deployment via VITE_*_BASE_URL build args (see
+    # web/Dockerfile) and a static nginx.conf has no way to know them.
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src *; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" always;
+
     location / {
         # adapter-static writes prerendered routes as flat <route>.html
         # files (e.g. /dashboards -> dashboards.html, confirmed by