fix: audit hardening 2.1.10-SAC — gitignore, SAC TLS warn, Exchange safety

- Extend .gitignore for local settings, logs, spool, backups
- Log CRITICAL when SacTlsSkipVerify is enabled (Login_Monitor + Sac-Client)
- Exchange-MailSecurity: -WhatIf dry-run, scan safety warnings, v1.6.8
- Remove legacy Watchdog_RDP_Monitor.ps1 and Install-ScheduledTasks.ps1
- Add scripts for GitHub sanitize mirror push workflow

scripts/Test-NoSecretsForGitHub.ps1

@@ -0,0 +1,46 @@
+# Fail if tracked text still contains production-only markers (run before GitHub push).
+$ErrorActionPreference = 'Stop'
+$Root = Split-Path -Parent $PSScriptRoot
+Set-Location $Root
+
+$patterns = @(
+    '8239219522',
+    'sac_UkOsAT',
+    '2843230',
+    'sac\.kalinamall\.ru',
+    '\\\\b26\\',
+    'K6A-DC3',
+    'fifth\.kalinamall',
+    '192\.168\.160\.57',
+    'kalinamall\.ru',
+    'git\.kalinamall\.ru',
+    'git\.papatramp\.ru',
+    '\d{8,12}:[A-Za-z0-9_-]{20,}'
+)
+
+$extensions = @('*.md', '*.ps1', '*.example', '*.txt', '*.json', '*.yml', '*.yaml')
+$files = git ls-files $extensions 2>$null | Where-Object { $_ -and (Test-Path $_) }
+
+$hits = @()
+foreach ($file in $files) {
+    if ($file -like 'scripts/Rewrite-GitHostUrls.ps1') { continue }
+    if ($file -like 'scripts/Push-PrivateMirror.ps1') { continue }
+    if ($file -like 'scripts/Sanitize-ForGitHub.ps1') { continue }
+    if ($file -like 'scripts/Test-NoSecretsForGitHub.ps1') { continue }
+    if ($file -like 'scripts/Push-GitHubMirror.ps1') { continue }
+
+    $text = Get-Content -LiteralPath $file -Raw -ErrorAction SilentlyContinue
+    if ([string]::IsNullOrEmpty($text)) { continue }
+
+    foreach ($pat in $patterns) {
+        if ($text -match $pat) {
+            $hits += "${file}: matches /$pat/"
+        }
+    }
+}
+
+if ($hits.Count -gt 0) {
+    Write-Error ("GitHub secret scan failed:`n" + ($hits -join "`n"))
+}
+
+Write-Output "GitHub secret scan: OK ($($files.Count) files)"