refactor: replace hardcoded mabase_prod DB prefix with configurable settings

Replace all hardcoded 'mabase_prod.' table prefixes in dashboard route
SQL queries with configurable database names from settings:

- http_logs, http_logs_raw → settings.CLICKHOUSE_DB_LOGS
- All other tables → settings.CLICKHOUSE_DB_PROCESSING

Also qualify previously unqualified table references (bare FROM/JOIN
table_name) with the appropriate database prefix for consistency.

Each route file now imports 'from ..config import settings' and uses
f-strings with {settings.CLICKHOUSE_DB_PROCESSING} or
{settings.CLICKHOUSE_DB_LOGS} for database-qualified table names.

Files updated: analysis, attributes, audit, botnets, bruteforce,
clustering, detections, entities, fingerprints, header_fingerprint,
heatmap, incidents, investigation_summary, metrics, ml_features,
rotation, search, tcp_spoofing, variability (19 files).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

services/dashboard/backend/routes/audit.py

@@ -6,6 +6,7 @@ from fastapi import APIRouter, HTTPException, Query, Request
 from typing import Optional
 from datetime import datetime
 from ..database import db
+from ..config import settings
 
 router = APIRouter(prefix="/api/audit", tags=["audit"])
 logger = logging.getLogger(__name__)
@@ -29,8 +30,8 @@ async def create_audit_log(
         client_ip = request.client.host if request.client else "unknown"
         
         # Insérer dans ClickHouse
-        insert_query = """
-        INSERT INTO mabase_prod.audit_logs 
+        insert_query = f"""
+        INSERT INTO {settings.CLICKHOUSE_DB_PROCESSING}.audit_logs 
         (timestamp, user_name, action, entity_type, entity_id, entity_count, details, client_ip)
         VALUES 
         (%(timestamp)s, %(user)s, %(action)s, %(entity_type)s, %(entity_id)s, %(entity_count)s, %(details)s, %(client_ip)s)
@@ -105,7 +106,7 @@ async def get_audit_logs(
             entity_count,
             details,
             client_ip
-        FROM mabase_prod.audit_logs
+        FROM {settings.CLICKHOUSE_DB_PROCESSING}.audit_logs
         WHERE {where_clause}
         ORDER BY timestamp DESC
         LIMIT %(limit)s
@@ -152,13 +153,13 @@ async def get_audit_stats(
     Statistiques d'audit
     """
     try:
-        query = """
+        query = f"""
         SELECT
             action,
             count() AS count,
             uniq(user_name) AS unique_users,
             sum(entity_count) AS total_entities
-        FROM mabase_prod.audit_logs
+        FROM {settings.CLICKHOUSE_DB_PROCESSING}.audit_logs
         WHERE timestamp >= now() - INTERVAL %(hours)s HOUR
         GROUP BY action
         ORDER BY count DESC
@@ -198,14 +199,14 @@ async def get_user_activity(
     Activité par utilisateur
     """
     try:
-        query = """
+        query = f"""
         SELECT
             user_name,
             count() AS actions,
             uniq(action) AS action_types,
             min(timestamp) AS first_action,
             max(timestamp) AS last_action
-        FROM mabase_prod.audit_logs
+        FROM {settings.CLICKHOUSE_DB_PROCESSING}.audit_logs
         WHERE timestamp >= now() - INTERVAL %(hours)s HOUR
         GROUP BY user_name
         ORDER BY actions DESC