Fix Matrix message formatting and harden security

Matrix alerts:
- Send HTML formatted_body (org.matrix.custom.html) so **bold** and URLs
  render instead of showing literal Markdown; add plain-text body fallback.
  Add dependency-free markdown_to_matrix_html/strip_markdown helpers with
  HTML escaping of station/message data.

Security:
- InfluxDB: bind untrusted station_codes as query params and cast limit to
  int (was f-string interpolation / injection risk).
- VictoriaMetrics: escape Prometheus label values and coerce metric values
  to float, preventing exposition-format injection and None crashes.
- web_api: run blocking scrape cycle via run_in_executor so it no longer
  freezes the event loop; make CORS origins configurable and only allow
  credentials with explicit origins ("*" + credentials is invalid/unsafe).
- config: remove hardcoded root/postgres password fallbacks (raise instead)
  and stop defaulting VM_HOST to a real infrastructure hostname.

Also remove unused imports and wrap long lines to satisfy flake8.

src/alerting.py

@@ -4,7 +4,9 @@ Water Level Alerting System with Matrix Integration
 """
 
 import datetime
+import html
 import os
+import re
 from dataclasses import dataclass
 from enum import Enum
 from typing import Dict, List, Optional
@@ -28,6 +30,31 @@ except ImportError:
 logger = get_logger(__name__)
 
 
+_BOLD_RE = re.compile(r"\*\*(.+?)\*\*")
+_URL_RE = re.compile(r"(https?://[^\s<]+)")
+
+
+def markdown_to_matrix_html(text: str) -> str:
+    """Convert the small Markdown subset we emit into Matrix-compatible HTML.
+
+    Matrix clients do NOT render Markdown in the plain ``body`` field; formatting
+    only shows when an HTML ``formatted_body`` is sent alongside it. We only use
+    ``**bold**``, bare URLs and newlines, so a minimal converter is sufficient and
+    avoids adding a Markdown dependency.
+    """
+    # Escape HTML special chars first so station/message data can't inject markup.
+    result = html.escape(text, quote=False)
+    result = _BOLD_RE.sub(r"<strong>\1</strong>", result)
+    result = _URL_RE.sub(r'<a href="\1">\1</a>', result)
+    result = result.replace("\n", "<br/>")
+    return result
+
+
+def strip_markdown(text: str) -> str:
+    """Produce a clean plain-text fallback for the Matrix ``body`` field."""
+    return _BOLD_RE.sub(r"\1", text)
+
+
 class AlertLevel(Enum):
     INFO = "info"
     WARNING = "warning"
@@ -55,16 +82,32 @@ class MatrixNotifier:
         self.room_id = room_id
         self.session = requests.Session()
 
-    def send_message(self, message: str, msgtype: str = "m.text") -> bool:
-        """Send message to Matrix room"""
+    def send_message(self, message: str, msgtype: str = "m.text", markdown: bool = True) -> bool:
+        """Send a message to the Matrix room.
+
+        When ``markdown`` is True (default) the ``message`` is treated as Markdown:
+        a rendered HTML ``formatted_body`` is sent so clients show real formatting,
+        with a plain-text ``body`` fallback for clients that ignore HTML.
+        """
         try:
             # Add transaction ID to prevent duplicates
             txn_id = datetime.datetime.now().strftime("%Y%m%d_%H%M%S_%f")
             url = f"{self.homeserver}/_matrix/client/v3/rooms/{self.room_id}/send/m.room.message/{txn_id}"
 
-            headers = {"Authorization": f"Bearer {self.access_token}", "Content-Type": "application/json"}
+            headers = {
+                "Authorization": f"Bearer {self.access_token}",
+                "Content-Type": "application/json",
+            }
 
-            data = {"msgtype": msgtype, "body": message}
+            if markdown:
+                data = {
+                    "msgtype": msgtype,
+                    "body": strip_markdown(message),
+                    "format": "org.matrix.custom.html",
+                    "formatted_body": markdown_to_matrix_html(message),
+                }
+            else:
+                data = {"msgtype": msgtype, "body": message}
 
             # Matrix API requires PUT when transaction ID is in the URL path
             response = self.session.put(url, headers=headers, json=data, timeout=10)
@@ -239,7 +282,12 @@ class WaterLevelAlertSystem:
                         ("zone_1", 3.7, AlertLevel.INFO, "Zone 1 - Info"),
                     ]
 
-                    for zone_name, zone_threshold, zone_alert_level, zone_description in zones:
+                    for (
+                        zone_name,
+                        zone_threshold,
+                        zone_alert_level,
+                        zone_description,
+                    ) in zones:
                         if water_level >= zone_threshold:
                             alert_level = zone_alert_level
                             threshold_value = zone_threshold
@@ -348,7 +396,9 @@ class WaterLevelAlertSystem:
                     # Get measurements for this station in the time window
                     current_time = datetime.datetime.now()
                     measurements = self.db_adapter.get_measurements_by_timerange(
-                        start_time=cutoff_time, end_time=current_time, station_codes=[station_code]
+                        start_time=cutoff_time,
+                        end_time=current_time,
+                        station_codes=[station_code],
                     )
 
                     if len(measurements) < 2: