fix: keep CrowdSec imports from disturbing live state and build exports safely

[Wikid82]

Summary

Follow-ups to #1542 for the CrowdSec configuration export and import, delivered as one PR.

Closes #1538, closes #1539, closes #1540

• chore: CrowdSec config import does not restore installed hub item links #1538: an import no longer disturbs the running system's own state. The installed hub tree and its links, runtime state and the bouncer registration are kept across a successful import and across a rollback, so CrowdSec keeps its installed items until the next start. Archive entries that would replace or sit under kept state are skipped. The export no longer carries the downloaded hub data.
• chore: review which stored settings the CrowdSec export includes #1539: resolved with a recorded decision and no code: notification settings and database connection settings stay in the export, because a profile that names a notification with no file stops CrowdSec from loading its configuration. The docs already ask users to treat an export as private. Redaction is tracked in chore: review notification settings in the CrowdSec export and check for missing notification files before import #1546.
• chore: CrowdSec export is not serialized with import and can be truncated on a mid-walk error #1540: the export is built in a temporary file under the data lock, checked against the import limits (50 MiB compressed, 100x ratio, 500 MiB source cap) and only then sent with a Content-Length. Failures return a clean error with a fixed message instead of a truncated archive. The lock is not held while streaming. Non-regular files are skipped, files are opened without following links, and the 50 MiB limit is enforced while writing.
• Also found and fixed along the way: the runtime state file was deleted by an import or preset apply (making the status read "not running"), and an import could replace the bouncer key registered in the kept database.

Testing

• Backend: coverage 91.3% statements / 90.3% lines; patch coverage 93.6%; go test -race on the crowdsec package and on the import/export/rollback handler tests; full golangci-lint config clean (backend and agent). Local CodeQL: Go "4 suppressed, 0 blocking", JS 0.
• E2E: the five CrowdSec security specs pass under --project=security-tests (92/92, no fixme).
• Manual check in a throwaway container (not the live proxy), HEAD before the final hardening commit: 56 hub item links, cscli collections list (hash), the runtime state file and the bouncer key hash were identical before and after an export-then-import; the export held 39 entries, all under config/, with a correct Content-Length, and no hub, runtime state or bouncer entries. Recreating the container with no network logged the non-fatal hub update failure and CrowdSec started with all items intact.
• A QA audit (docs/reports/qa_report.md) found no critical, high or medium issues; its two low findings are fixed in this PR.

Notes

• Known follow-ups: chore: restore the installed CrowdSec hub item set when moving a configuration to a different host #1545 (restore the installed hub item set on a different host), chore: review notification settings in the CrowdSec export and check for missing notification files before import #1546 (notification settings in the export), chore: translate the CrowdSec export success and failure toasts #1547 (translate the export toasts), test: several backend tests cannot be repeated in one process (go test -count>1) #1548 (tests that cannot be repeated with -count>1; pre-existing).
• One pre-existing load-sensitive frontend test (Notifications.test.tsx, a 5 s timeout) failed once in a full coverage run and passed on rerun; this PR changes no frontend code.
• chore: use filepath.Rel for the CrowdSec diagnostics path containment checks #1541 is being handled by a contributor in crowdsec: enforce strict path containment in diagnostics handlers #1543.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

✅ Supply Chain Verification Results

✅ PASSED

📦 SBOM Summary

• Components: 1870

🔍 Vulnerability Scan

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	0
🟢 Low	0
Total	0

📎 Artifacts

• SBOM (CycloneDX JSON) and Grype results available in workflow artifacts

---

_{Generated by Supply Chain Verification workflow • View Details}

[codecov]

Codecov Report

❌ Patch coverage is 92.27053% with 16 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
backend/internal/api/handlers/crowdsec_handler.go	84.61%	12 Missing ⚠️
backend/internal/crowdsec/export.go	95.95%	4 Missing ⚠️

📢 Thoughts on this report? Let us know!