feat(security): protect sensitive values in CrowdSec exports

[Wikid82]

Summary

Exported CrowdSec configurations no longer carry passwords, tokens or webhook addresses from notification files, and importing one keeps your current values. 12 ordered commits.

• Export: notification settings are exported with their sensitive values blanked (names, types and plain settings stay readable). Anything that cannot be blanked safely is exported as an empty file, never as written. Stray non-YAML files in notification folders are left out.
• Import: a blanked export fills in the current values for notifications that already exist with the same type, name and target. Anything else keeps its placeholder, and the import card shows one passive line listing the files that still need values (translated in de, en, es, fr, zh).
• Docs: feature guide and troubleshooting entry, including the known limits.
• Tooling: the pre-commit phase now lints staged markdown files (config relaxed for pre-existing prose; a repo-wide cleanup follows separately).

Verification

• Backend coverage 91.5% statements / 90.5% lines; frontend 91.5% lines; patch coverage 96.5%.
• Full golangci-lint clean; race tests on the crowdsec and handlers packages; go build, npm run build and type-check pass.
• Property and fuzz tests over the rewriter (120 s fuzz run, about 536k executions, no failures); adversarial probes in QA.
• Local CodeQL: Go 4 results (all pre-existing suppressions, none in this diff), JS 0. Trivy: no high/critical.
• Targeted E2E (--project=security-tests): 93 passed, 0 skipped.
• QA verdict PASS. Report: docs/reports/qa_report.md.

Issues

Closing keywords only take effect on merge to main, so these stay open until the promotion.

Closes #1551, #1546

[github-actions]

✅ Supply Chain Verification Results

✅ PASSED

📦 SBOM Summary

• Components: 1870

🔍 Vulnerability Scan

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	0
🟢 Low	0
Total	0

📎 Artifacts

• SBOM (CycloneDX JSON) and Grype results available in workflow artifacts

---

_{Generated by Supply Chain Verification workflow • View Details}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[codecov]

Codecov Report

❌ Patch coverage is 96.65072% with 21 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
backend/internal/crowdsec/export.go	87.50%	10 Missing ⚠️
backend/internal/api/handlers/crowdsec_handler.go	83.33%	5 Missing ⚠️
backend/internal/crowdsec/redact.go	97.72%	4 Missing ⚠️
backend/internal/crowdsec/notifications_files.go	99.05%	1 Missing ⚠️
backend/internal/crowdsec/redact_merge.go	99.53%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!