fix: audit hardening 2.1.10-SAC — gitignore, SAC TLS warn, Exchange safety

- Extend .gitignore for local settings, logs, spool, backups
- Log CRITICAL when SacTlsSkipVerify is enabled (Login_Monitor + Sac-Client)
- Exchange-MailSecurity: -WhatIf dry-run, scan safety warnings, v1.6.8
- Remove legacy Watchdog_RDP_Monitor.ps1 and Install-ScheduledTasks.ps1
- Add scripts for GitHub sanitize mirror push workflow

Exchange-MailSecurity.ps1

@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
     Мониторинг Exchange: очереди транспорта, пересылка на внешние адреса (Inbox rules + mailbox forwarding + transport rules).
 .DESCRIPTION
@@ -10,12 +10,13 @@
     Опционально: exchange_monitor.settings.ps1 в том же каталоге (секреты, whitelist).
 #>
 
-[CmdletBinding()]
+[CmdletBinding(SupportsShouldProcess = $true)]
 param(
     [ValidateSet('Queues', 'Inbox', 'Watchdog')]
     [string]$Mode = 'Queues',
     [switch]$InstallTasks,
-    [switch]$Watchdog
+    [switch]$Watchdog,
+    [switch]$WhatIf
 )
 
 Set-StrictMode -Version Latest
@@ -25,7 +26,7 @@ $ErrorActionPreference = 'Stop'
 # КОНФИГУРАЦИЯ
 # ============================================
 
-$ScriptVersion = '1.6.7'
+$ScriptVersion = '1.6.8'
 $script:InstallRoot = [System.IO.Path]::GetFullPath("$env:ProgramData\RDP-login-monitor")
 $script:CanonicalScriptName = 'Exchange-MailSecurity.ps1'
 $LogFile = Join-Path $script:InstallRoot 'Logs\exchange_mail_security.log'
@@ -100,6 +101,18 @@ if (Test-Path -LiteralPath $SettingsFile) {
     . $SettingsFile
 }
 
+function Write-ExchangeScanSafetyWarnings {
+    if (-not $SuppressAlertsOnFirstBaselineRun) {
+        Write-ExchLog 'WARN: SuppressAlertsOnFirstBaselineRun=$false — первый Inbox-скан может разослать алерты по всем уже существующим пересылкам.'
+    }
+    if (-not $VipMailboxesOnly -and $MaxMailboxesPerRun -le 0 -and $ScanInboxRules) {
+        Write-ExchLog 'WARN: полный скан Inbox rules по всем ящикам (VipMailboxesOnly=$false). Рекомендуется пилот: VipMailboxesOnly=$true или -Mode Inbox -WhatIf.'
+    }
+    if (@($SkipInboxScanMailboxes | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }).Count -eq 0) {
+        Write-ExchLog 'TIP: добавьте проблемные ящики в $SkipInboxScanMailboxes, если Get-InboxRule падает (corrupt rule store).'
+    }
+}
+
 function Write-NotifyLog {
     param([string]$Message)
     Write-ExchLog $Message
@@ -235,6 +248,7 @@ if ($InstallTasks) {
         Send-ExchangeInstallNotification
         Write-ExchLog 'InstallTasks: install notification sent'
     }
+    Write-ExchLog 'InstallTasks: перед первым ночным Inbox-сканом выполните: Exchange-MailSecurity.ps1 -Mode Inbox -WhatIf'
     exit 0
 }
 
@@ -518,6 +532,15 @@ function Invoke-ExchangeQueueScan {
     Write-ExchLog "Queues: threshold MessageCount > $QueueMessageCountThreshold"
 
     $queues = @(Get-Queue -ErrorAction Stop)
+    if ($WhatIf) {
+        $hot = @($queues | Where-Object { $_.MessageCount -gt $QueueMessageCountThreshold })
+        Write-ExchLog "WhatIf: queues total=$($queues.Count), above threshold=$($hot.Count) — alerts skipped"
+        foreach ($q in $hot) {
+            Write-ExchLog "WhatIf: would alert queue=$($q.Identity) messages=$($q.MessageCount)"
+        }
+        return
+    }
+
     $hot = @($queues | Where-Object { $_.MessageCount -gt $QueueMessageCountThreshold })
     $state = Get-QueueAlertState
     $now = Get-Date
@@ -760,6 +783,20 @@ function Send-ExchangeInboxScanSummary {
 function Invoke-ExchangeInboxAndForwardingScan {
     $scopeLabel = Get-ExchangeInboxScanScopeLabel
     Write-ExchLog "Inbox/Forwarding scan v$ScriptVersion; scope: $scopeLabel; notify: $(Get-NotifyChainHuman)"
+    if ($WhatIf) {
+        $null = Import-ExchangeManagementShell
+        $internalDomains = Get-InternalAcceptedDomainNames
+        Write-ExchLog "WhatIf: accepted domains: $(@($internalDomains) -join ', ')"
+        $mailboxCount = 0
+        if ($ScanInboxRules) {
+            $mailboxes = @(Get-MailboxListForScan)
+            $mailboxCount = $mailboxes.Count
+            Write-ExchLog "WhatIf: would scan $mailboxCount mailboxes ($scopeLabel); Get-InboxRule not called"
+        }
+        Write-ExchLog "WhatIf: ScanMailboxForwarding=$ScanMailboxForwarding ScanTransportRules=$ScanTransportRules — no alerts, no baseline write"
+        return
+    }
+
     $null = Import-ExchangeManagementShell
     $internalDomains = Get-InternalAcceptedDomainNames
     Write-ExchLog "Accepted domains (internal): $(@($internalDomains) -join ', ')"
@@ -879,7 +916,8 @@ if (-not (Test-RunningElevated)) {
     Write-ExchLog 'WARNING: not running elevated - EMS/tasks may fail.'
 }
 
-Write-ExchLog "=== Exchange-MailSecurity v$ScriptVersion Mode=$Mode ==="
+Write-ExchLog "=== Exchange-MailSecurity v$ScriptVersion Mode=$Mode$(if ($WhatIf) { ' WhatIf' }) ==="
+Write-ExchangeScanSafetyWarnings
 
 try {
     switch ($Mode) {