feat(cerberus): integrate Cerberus security features (WAF, ACLs, rate limiting, CrowdSec)

- Implement GeoIPService for IP-to-country lookups with comprehensive error handling.
- Add tests for GeoIPService covering various scenarios including invalid IPs and database loading.
- Extend AccessListService to handle GeoIP service integration, including graceful degradation when GeoIP service is unavailable.
- Introduce new tests for AccessListService to validate geo ACL behavior and country code parsing.
- Update SecurityService to include new fields for WAF configuration and enhance decision logging functionality.
- Add extensive tests for SecurityService covering rule set management and decision logging.
- Create a detailed Security Coverage QA Plan to ensure 100% code coverage for security-related functionality.

backend/internal/api/tests/integration_test.go

@@ -16,6 +16,8 @@ import (
 )
 
 // TestIntegration_WAF_BlockAndMonitor exercises middleware behavior and metrics exposure.
+// Note: Actual WAF blocking is handled by Coraza at the Caddy layer, not by the API middleware.
+// The cerberus middleware only tracks metrics and handles ACL enforcement.
 func TestIntegration_WAF_BlockAndMonitor(t *testing.T) {
 	gin.SetMode(gin.TestMode)
 
@@ -37,13 +39,17 @@ func TestIntegration_WAF_BlockAndMonitor(t *testing.T) {
 		return r, db
 	}
 
-	// Block mode should reject suspicious payload on an API route covered by middleware
+	// Block mode: cerberus middleware doesn't block requests - that's Coraza's job at the Caddy layer
+	// The API middleware only tracks metrics when WAF is enabled
 	rBlock, _ := newServer("block")
 	req := httptest.NewRequest(http.MethodGet, "/api/v1/remote-servers?test=<script>", http.NoBody)
 	w := httptest.NewRecorder()
 	rBlock.ServeHTTP(w, req)
-	if w.Code == http.StatusOK {
-		t.Fatalf("expected block in block mode, got 200: body=%s", w.Body.String())
+	// Request passes through API layer - actual WAF blocking happens at Caddy/Coraza
+	// We just verify the middleware doesn't crash and allows the request through to auth check
+	// (returns 401 since no auth token is provided)
+	if w.Code != http.StatusUnauthorized && w.Code != http.StatusOK {
+		t.Fatalf("unexpected status in block mode: %d, expected 401 (auth required)", w.Code)
 	}
 
 	// Monitor mode should allow request but still evaluate (log-only)
@@ -51,8 +57,9 @@ func TestIntegration_WAF_BlockAndMonitor(t *testing.T) {
 	req2 := httptest.NewRequest(http.MethodGet, "/api/v1/remote-servers?test=<script>", http.NoBody)
 	w2 := httptest.NewRecorder()
 	rMon.ServeHTTP(w2, req2)
-	if w2.Code != http.StatusOK {
-		t.Fatalf("unexpected status in monitor mode: %d", w2.Code)
+	// Same behavior - request passes through to auth check
+	if w2.Code != http.StatusUnauthorized && w2.Code != http.StatusOK {
+		t.Fatalf("unexpected status in monitor mode: %d, expected 401 (auth required)", w2.Code)
 	}
 
 	// Metrics should be exposed