refactor: replace hardcoded mabase_prod DB prefix with configurable settings

Replace all hardcoded 'mabase_prod.' table prefixes in dashboard route
SQL queries with configurable database names from settings:

- http_logs, http_logs_raw → settings.CLICKHOUSE_DB_LOGS
- All other tables → settings.CLICKHOUSE_DB_PROCESSING

Also qualify previously unqualified table references (bare FROM/JOIN
table_name) with the appropriate database prefix for consistency.

Each route file now imports 'from ..config import settings' and uses
f-strings with {settings.CLICKHOUSE_DB_PROCESSING} or
{settings.CLICKHOUSE_DB_LOGS} for database-qualified table names.

Files updated: analysis, attributes, audit, botnets, bruteforce,
clustering, detections, entities, fingerprints, header_fingerprint,
heatmap, incidents, investigation_summary, metrics, ml_features,
rotation, search, tcp_spoofing, variability (19 files).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

services/dashboard/backend/routes/heatmap.py

@@ -5,6 +5,7 @@ from collections import defaultdict
 from fastapi import APIRouter, HTTPException, Query
 
 from ..database import db
+from ..config import settings
 
 router = APIRouter(prefix="/api/heatmap", tags=["heatmap"])
 
@@ -13,13 +14,13 @@ router = APIRouter(prefix="/api/heatmap", tags=["heatmap"])
 async def get_heatmap_hourly():
     """Hits agrégés par heure sur les 72 dernières heures."""
     try:
-        sql = """
+        sql = f"""
         SELECT
             toHour(window_start)                                                    AS hour,
             sum(hits)                                                               AS hits,
             uniq(replaceRegexpAll(toString(src_ip), '^::ffff:', ''))               AS unique_ips,
             max(max_requests_per_sec)                                               AS max_rps
-        FROM mabase_prod.agg_host_ip_ja4_1h
+        FROM {settings.CLICKHOUSE_DB_PROCESSING}.agg_host_ip_ja4_1h
         WHERE window_start >= now() - INTERVAL 72 HOUR
         GROUP BY hour
         ORDER BY hour ASC
@@ -44,13 +45,13 @@ async def get_heatmap_top_hosts(limit: int = Query(20, ge=1, le=100)):
     """Hôtes les plus ciblés avec répartition horaire sur 24h."""
     try:
         # Aggregate overall stats per host
-        agg_sql = """
+        agg_sql = f"""
         SELECT
             host,
             sum(hits)                                                               AS total_hits,
             uniq(replaceRegexpAll(toString(src_ip), '^::ffff:', ''))               AS unique_ips,
             uniq(ja4)                                                               AS unique_ja4s
-        FROM mabase_prod.agg_host_ip_ja4_1h
+        FROM {settings.CLICKHOUSE_DB_PROCESSING}.agg_host_ip_ja4_1h
         WHERE window_start >= now() - INTERVAL 72 HOUR
         GROUP BY host
         ORDER BY total_hits DESC
@@ -72,12 +73,12 @@ async def get_heatmap_top_hosts(limit: int = Query(20, ge=1, le=100)):
             return {"items": []}
 
         # Hourly breakdown per host
-        hourly_sql = """
+        hourly_sql = f"""
         SELECT
             host,
             toHour(window_start) AS hour,
             sum(hits)            AS hits
-        FROM mabase_prod.agg_host_ip_ja4_1h
+        FROM {settings.CLICKHOUSE_DB_PROCESSING}.agg_host_ip_ja4_1h
         WHERE window_start >= now() - INTERVAL 72 HOUR
           AND host IN %(hosts)s
         GROUP BY host, hour
@@ -106,9 +107,9 @@ async def get_heatmap_top_hosts(limit: int = Query(20, ge=1, le=100)):
 async def get_heatmap_matrix():
     """Matrice top-15 hôtes × 24 heures (sum hits) sur les 72 dernières heures."""
     try:
-        top_sql = """
+        top_sql = f"""
         SELECT host, sum(hits) AS total_hits
-        FROM mabase_prod.agg_host_ip_ja4_1h
+        FROM {settings.CLICKHOUSE_DB_PROCESSING}.agg_host_ip_ja4_1h
         WHERE window_start >= now() - INTERVAL 72 HOUR
         GROUP BY host
         ORDER BY total_hits DESC
@@ -119,12 +120,12 @@ async def get_heatmap_matrix():
         if not top_hosts:
             return {"hosts": [], "matrix": []}
 
-        cell_sql = """
+        cell_sql = f"""
         SELECT
             host,
             toHour(window_start) AS hour,
             sum(hits)            AS hits
-        FROM mabase_prod.agg_host_ip_ja4_1h
+        FROM {settings.CLICKHOUSE_DB_PROCESSING}.agg_host_ip_ja4_1h
         WHERE window_start >= now() - INTERVAL 72 HOUR
           AND host IN %(hosts)s
         GROUP BY host, hour