feat(security): extend rate limits on sync, tests, evidence and reports [FASE-3.4]

backend/app/routers/system.py

@@ -7,7 +7,7 @@ scheduler health introspection.
 
 import logging
 
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter, Depends, Request
 from sqlalchemy.orm import Session
 
 from app.database import get_db
@@ -17,6 +17,7 @@ from app.services.mitre_sync_service import sync_mitre
 from app.services.intel_service import scan_intel
 from app.services.atomic_import_service import import_atomic_red_team
 from app.jobs.mitre_sync_job import scheduler
+from app.limiter import limiter
 
 logger = logging.getLogger(__name__)
 
@@ -24,7 +25,9 @@ router = APIRouter(prefix="/system", tags=["system"])
 
 
 @router.post("/sync-mitre")
+@limiter.limit("2/hour")
 def trigger_mitre_sync(
+    request: Request,
     db: Session = Depends(get_db),
     current_user: User = Depends(require_role("admin")),
 ):
@@ -63,7 +66,9 @@ def trigger_intel_scan(
 
 
 @router.post("/import-atomic-tests")
+@limiter.limit("2/hour")
 def trigger_atomic_import(
+    request: Request,
     db: Session = Depends(get_db),
     current_user: User = Depends(require_role("admin")),
 ):