refactor: replace hardcoded mabase_prod DB prefix with configurable settings

Replace all hardcoded 'mabase_prod.' table prefixes in dashboard route
SQL queries with configurable database names from settings:

- http_logs, http_logs_raw → settings.CLICKHOUSE_DB_LOGS
- All other tables → settings.CLICKHOUSE_DB_PROCESSING

Also qualify previously unqualified table references (bare FROM/JOIN
table_name) with the appropriate database prefix for consistency.

Each route file now imports 'from ..config import settings' and uses
f-strings with {settings.CLICKHOUSE_DB_PROCESSING} or
{settings.CLICKHOUSE_DB_LOGS} for database-qualified table names.

Files updated: analysis, attributes, audit, botnets, bruteforce,
clustering, detections, entities, fingerprints, header_fingerprint,
heatmap, incidents, investigation_summary, metrics, ml_features,
rotation, search, tcp_spoofing, variability (19 files).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

services/dashboard/backend/routes/bruteforce.py

@@ -4,6 +4,7 @@ Endpoints pour l'analyse des attaques par force brute sur les formulaires
 from fastapi import APIRouter, HTTPException, Query
 
 from ..database import db
+from ..config import settings
 
 router = APIRouter(prefix="/api/bruteforce", tags=["bruteforce"])
 
@@ -12,14 +13,14 @@ router = APIRouter(prefix="/api/bruteforce", tags=["bruteforce"])
 async def get_bruteforce_targets():
     """Liste des hôtes ciblés par brute-force, triés par total_hits DESC."""
     try:
-        sql = """
+        sql = f"""
         SELECT
             host,
             uniq(src_ip)            AS unique_ips,
             sum(hits)               AS total_hits,
             sum(query_params_count) AS total_params,
             groupArray(3)(ja4)      AS top_ja4s
-        FROM mabase_prod.view_form_bruteforce_detected
+        FROM {settings.CLICKHOUSE_DB_PROCESSING}.view_form_bruteforce_detected
         GROUP BY host
         ORDER BY total_hits DESC
         """
@@ -53,14 +54,14 @@ async def get_bruteforce_targets():
 async def get_bruteforce_attackers(limit: int = Query(50, ge=1, le=500)):
     """Top IPs attaquantes triées par total_hits DESC."""
     try:
-        sql = """
+        sql = f"""
         SELECT
             replaceRegexpAll(toString(src_ip), '^::ffff:', '') AS ip,
             uniq(host)              AS distinct_hosts,
             sum(hits)               AS total_hits,
             sum(query_params_count) AS total_params,
             argMax(ja4, hits)       AS ja4
-        FROM mabase_prod.view_form_bruteforce_detected
+        FROM {settings.CLICKHOUSE_DB_PROCESSING}.view_form_bruteforce_detected
         GROUP BY src_ip
         ORDER BY total_hits DESC
         LIMIT %(limit)s
@@ -84,12 +85,12 @@ async def get_bruteforce_attackers(limit: int = Query(50, ge=1, le=500)):
 async def get_bruteforce_timeline():
     """Hits par heure (dernières 72h) depuis agg_host_ip_ja4_1h."""
     try:
-        sql = """
+        sql = f"""
         SELECT
             toHour(window_start)                                        AS hour,
             sum(hits)                                                   AS hits,
             uniq(replaceRegexpAll(toString(src_ip), '^::ffff:', ''))   AS ips
-        FROM mabase_prod.agg_host_ip_ja4_1h
+        FROM {settings.CLICKHOUSE_DB_PROCESSING}.agg_host_ip_ja4_1h
         WHERE window_start >= now() - INTERVAL 72 HOUR
         GROUP BY hour
         ORDER BY hour ASC
@@ -111,14 +112,14 @@ async def get_bruteforce_timeline():
 async def get_host_attackers(host: str, limit: int = Query(20, ge=1, le=200)):
     """Top IPs attaquant un hôte spécifique, avec JA4 et type d'attaque."""
     try:
-        sql = """
+        sql = f"""
         SELECT
             replaceRegexpAll(toString(src_ip), '^::ffff:', '') AS ip,
             sum(hits)               AS total_hits,
             sum(query_params_count) AS total_params,
             argMax(ja4, hits)       AS ja4,
             max(hits)               AS max_hits_per_window
-        FROM mabase_prod.view_form_bruteforce_detected
+        FROM {settings.CLICKHOUSE_DB_PROCESSING}.view_form_bruteforce_detected
         WHERE host = %(host)s
         GROUP BY src_ip
         ORDER BY total_hits DESC