fix(backend): relax SSRF validation for loopback in dev, graceful metrics/regexploit fallback

- ip_utils: allow loopback (127.0.0.1) in dev mode (BANGUI_LOG_LEVEL=debug)
  so e2e tests can reach a mock HTTP server on the host
- metrics: make all operations no-ops when prometheus_client not installed
- regex_validator: graceful fallback when regexploit not installed
- geo_cache: use attribute access instead of dict subscript for typed rows
- rate_limit: support bucket_override parameter for per-endpoint rate limits
- ban_service: construct DomainActiveBan explicitly instead of model_copy

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/app/utils/regex_validator.py

@@ -12,8 +12,15 @@ from contextlib import contextmanager
 from typing import TYPE_CHECKING
 
 import structlog
-from regexploit.ast.sre import SreOpParser
-from regexploit.redos import Redos, find
+
+try:
+    from regexploit.ast.sre import SreOpParser
+    from regexploit.redos import Redos, find
+
+    _REGEXPLOIT_AVAILABLE = True
+except ImportError:
+    SreOpParser = Redos = find = None
+    _REGEXPLOIT_AVAILABLE = False
 
 if TYPE_CHECKING:
     from collections.abc import Generator
@@ -65,7 +72,7 @@ class ReDoSDetectedError(Exception):
         )
 
 
-def _check_redos(pattern: str) -> Redos | None:
+def _check_redos(pattern: str) -> "Redos | None":
     """Check if a pattern has catastrophic backtracking.
 
     Args:
@@ -74,6 +81,9 @@ def _check_redos(pattern: str) -> Redos | None:
     Returns:
         A Redos object if vulnerability detected, None otherwise.
     """
+    if not _REGEXPLOIT_AVAILABLE:
+        return None
+
     try:
         parsed = SreOpParser().parse_sre(pattern, 0)
     except re.error: