refactor: replace hardcoded mabase_prod DB prefix with configurable settings

Replace all hardcoded 'mabase_prod.' table prefixes in dashboard route
SQL queries with configurable database names from settings:

- http_logs, http_logs_raw → settings.CLICKHOUSE_DB_LOGS
- All other tables → settings.CLICKHOUSE_DB_PROCESSING

Also qualify previously unqualified table references (bare FROM/JOIN
table_name) with the appropriate database prefix for consistency.

Each route file now imports 'from ..config import settings' and uses
f-strings with {settings.CLICKHOUSE_DB_PROCESSING} or
{settings.CLICKHOUSE_DB_LOGS} for database-qualified table names.

Files updated: analysis, attributes, audit, botnets, bruteforce,
clustering, detections, entities, fingerprints, header_fingerprint,
heatmap, incidents, investigation_summary, metrics, ml_features,
rotation, search, tcp_spoofing, variability (19 files).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

services/dashboard/backend/routes/metrics.py

@@ -4,6 +4,7 @@ Endpoints pour les métriques du dashboard
 from fastapi import APIRouter, HTTPException
 from ..database import db
 from ..models import MetricsResponse, MetricsSummary, TimeSeriesPoint
+from ..config import settings
 
 router = APIRouter(prefix="/api/metrics", tags=["metrics"])
 
@@ -15,7 +16,7 @@ async def get_metrics():
     """
     try:
         # Résumé des métriques
-        summary_query = """
+        summary_query = f"""
         SELECT
             count() AS total_detections,
             countIf(threat_level = 'CRITICAL') AS critical_count,
@@ -25,7 +26,7 @@ async def get_metrics():
             countIf(bot_name != '') AS known_bots_count,
             countIf(bot_name = '') AS anomalies_count,
             uniq(src_ip) AS unique_ips
-        FROM ml_detected_anomalies
+        FROM {settings.CLICKHOUSE_DB_PROCESSING}.ml_detected_anomalies
         WHERE detected_at >= now() - INTERVAL 24 HOUR
         """
         
@@ -47,7 +48,7 @@ async def get_metrics():
         )
         
         # Série temporelle (par heure)
-        timeseries_query = """
+        timeseries_query = f"""
         SELECT
             toStartOfHour(detected_at) AS hour,
             count() AS total,
@@ -55,7 +56,7 @@ async def get_metrics():
             countIf(threat_level = 'HIGH') AS high,
             countIf(threat_level = 'MEDIUM') AS medium,
             countIf(threat_level = 'LOW') AS low
-        FROM ml_detected_anomalies
+        FROM {settings.CLICKHOUSE_DB_PROCESSING}.ml_detected_anomalies
         WHERE detected_at >= now() - INTERVAL 24 HOUR
         GROUP BY hour
         ORDER BY hour
@@ -98,12 +99,12 @@ async def get_threat_distribution():
     Récupère la répartition par niveau de menace
     """
     try:
-        query = """
+        query = f"""
         SELECT
             threat_level,
             count() AS count,
             round(count() * 100.0 / sum(count()) OVER (), 2) AS percentage
-        FROM ml_detected_anomalies
+        FROM {settings.CLICKHOUSE_DB_PROCESSING}.ml_detected_anomalies
         WHERE detected_at >= now() - INTERVAL 24 HOUR
         GROUP BY threat_level
         ORDER BY count DESC
@@ -128,7 +129,7 @@ async def get_metrics_baseline():
     Compare les métriques actuelles (24h) vs hier (24h-48h) pour afficher les tendances.
     """
     try:
-        query = """
+        query = f"""
         SELECT
             countIf(detected_at >= now() - INTERVAL 24 HOUR)                            AS today_total,
             countIf(detected_at >= now() - INTERVAL 48 HOUR AND detected_at < now() - INTERVAL 24 HOUR) AS yesterday_total,
@@ -136,7 +137,7 @@ async def get_metrics_baseline():
             uniqIf(src_ip, detected_at >= now() - INTERVAL 48 HOUR AND detected_at < now() - INTERVAL 24 HOUR) AS yesterday_ips,
             countIf(threat_level = 'CRITICAL' AND detected_at >= now() - INTERVAL 24 HOUR) AS today_critical,
             countIf(threat_level = 'CRITICAL' AND detected_at >= now() - INTERVAL 48 HOUR AND detected_at < now() - INTERVAL 24 HOUR) AS yesterday_critical
-        FROM ml_detected_anomalies
+        FROM {settings.CLICKHOUSE_DB_PROCESSING}.ml_detected_anomalies
         WHERE detected_at >= now() - INTERVAL 48 HOUR
         """
         r = db.query(query)