refactor: replace hardcoded mabase_prod DB prefix with configurable settings

Replace all hardcoded 'mabase_prod.' table prefixes in dashboard route
SQL queries with configurable database names from settings:

- http_logs, http_logs_raw → settings.CLICKHOUSE_DB_LOGS
- All other tables → settings.CLICKHOUSE_DB_PROCESSING

Also qualify previously unqualified table references (bare FROM/JOIN
table_name) with the appropriate database prefix for consistency.

Each route file now imports 'from ..config import settings' and uses
f-strings with {settings.CLICKHOUSE_DB_PROCESSING} or
{settings.CLICKHOUSE_DB_LOGS} for database-qualified table names.

Files updated: analysis, attributes, audit, botnets, bruteforce,
clustering, detections, entities, fingerprints, header_fingerprint,
heatmap, incidents, investigation_summary, metrics, ml_features,
rotation, search, tcp_spoofing, variability (19 files).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

services/dashboard/backend/routes/rotation.py

@@ -4,6 +4,7 @@ Endpoints pour la détection de la rotation de fingerprints JA4 et des menaces p
 from fastapi import APIRouter, HTTPException, Query
 
 from ..database import db
+from ..config import settings
 
 router = APIRouter(prefix="/api/rotation", tags=["rotation"])
 
@@ -12,12 +13,12 @@ router = APIRouter(prefix="/api/rotation", tags=["rotation"])
 async def get_ja4_rotators(limit: int = Query(50, ge=1, le=500)):
     """IPs qui effectuent le plus de rotation de fingerprints JA4."""
     try:
-        sql = """
+        sql = f"""
         SELECT
             replaceRegexpAll(toString(src_ip), '^::ffff:', '') AS ip,
             distinct_ja4_count,
             total_hits
-        FROM mabase_prod.view_host_ip_ja4_rotation
+        FROM {settings.CLICKHOUSE_DB_PROCESSING}.view_host_ip_ja4_rotation
         ORDER BY distinct_ja4_count DESC
         LIMIT %(limit)s
         """
@@ -40,7 +41,7 @@ async def get_ja4_rotators(limit: int = Query(50, ge=1, le=500)):
 async def get_persistent_threats(limit: int = Query(100, ge=1, le=1000)):
     """Menaces persistantes triées par score de persistance."""
     try:
-        sql = """
+        sql = f"""
         SELECT
             replaceRegexpAll(toString(src_ip), '^::ffff:', '') AS ip,
             recurrence,
@@ -48,7 +49,7 @@ async def get_persistent_threats(limit: int = Query(100, ge=1, le=1000)):
             worst_threat_level,
             first_seen,
             last_seen
-        FROM mabase_prod.view_ip_recurrence
+        FROM {settings.CLICKHOUSE_DB_PROCESSING}.view_ip_recurrence
         ORDER BY (least(100, recurrence * 20 + worst_score * 50)) DESC
         LIMIT %(limit)s
         """
@@ -75,13 +76,13 @@ async def get_persistent_threats(limit: int = Query(100, ge=1, le=1000)):
 async def get_ip_ja4_history(ip: str):
     """Historique des JA4 utilisés par une IP donnée."""
     try:
-        sql = """
+        sql = f"""
         SELECT
             ja4,
             sum(hits)       AS hits,
             min(window_start) AS first_seen,
             max(window_start) AS last_seen
-        FROM mabase_prod.agg_host_ip_ja4_1h
+        FROM {settings.CLICKHOUSE_DB_PROCESSING}.agg_host_ip_ja4_1h
         WHERE replaceRegexpAll(toString(src_ip), '^::ffff:', '') = %(ip)s
         GROUP BY ja4
         ORDER BY hits DESC
@@ -107,7 +108,7 @@ async def get_sophistication(limit: int = Query(50, ge=1, le=500)):
     Single SQL JOIN query — aucun traitement Python sur 34K entrées.
     """
     try:
-        sql = """
+        sql = f"""
         SELECT
             r.ip,
             r.distinct_ja4_count,
@@ -122,20 +123,20 @@ async def get_sophistication(limit: int = Query(50, ge=1, le=500)):
             SELECT
                 replaceRegexpAll(toString(src_ip), '^::ffff:', '') AS ip,
                 distinct_ja4_count
-            FROM mabase_prod.view_host_ip_ja4_rotation
+            FROM {settings.CLICKHOUSE_DB_PROCESSING}.view_host_ip_ja4_rotation
         ) r
         LEFT JOIN (
             SELECT
                 replaceRegexpAll(toString(src_ip), '^::ffff:', '') AS ip,
                 count() AS recurrence
-            FROM mabase_prod.ml_detected_anomalies FINAL
+            FROM {settings.CLICKHOUSE_DB_PROCESSING}.ml_detected_anomalies FINAL
             GROUP BY ip
         ) rec ON r.ip = rec.ip
         LEFT JOIN (
             SELECT
                 replaceRegexpAll(toString(src_ip), '^::ffff:', '') AS ip,
                 sum(hits) AS bruteforce_hits
-            FROM mabase_prod.view_form_bruteforce_detected
+            FROM {settings.CLICKHOUSE_DB_PROCESSING}.view_form_bruteforce_detected
             GROUP BY ip
         ) bf ON r.ip = bf.ip
         ORDER BY sophistication_score DESC
@@ -174,7 +175,7 @@ async def get_proactive_hunt(
 ):
     """IPs volant sous le radar : récurrentes mais sous le seuil de détection normal."""
     try:
-        sql = """
+        sql = f"""
         SELECT
             replaceRegexpAll(toString(src_ip), '^::ffff:', '') AS ip,
             recurrence,
@@ -183,7 +184,7 @@ async def get_proactive_hunt(
             first_seen,
             last_seen,
             dateDiff('day', first_seen, last_seen) AS days_active
-        FROM mabase_prod.view_ip_recurrence
+        FROM {settings.CLICKHOUSE_DB_PROCESSING}.view_ip_recurrence
         WHERE recurrence >= %(min_recurrence)s
           AND abs(worst_score) < 0.5
           AND dateDiff('day', first_seen, last_seen) >= %(min_days)s