fix: restore production secrets on kalinamall and repair placeholder settings (2.1.8-SAC)

Real SAC/Telegram tokens and org paths back in example and NETLOGON publish script. Deploy now treats sac.example.com and sac_CHANGE_ME as unconfigured and overwrites from example.

Co-authored-by: Cursor <cursoragent@cursor.com>

Deploy-LoginMonitor.ps1

@@ -260,11 +260,25 @@ function Copy-RdpMonitorDeployBundle {
     }
 }
 
+function Test-RdpMonitorSettingsHasPlaceholderSecrets {
+    param([string]$SettingsPath)
+    $c = Get-RdpMonitorSettingsRaw -Path $SettingsPath
+    if ([string]::IsNullOrWhiteSpace($c)) { return $true }
+
+    if ($c -match '(?m)^\s*\$SacUrl\s*=\s*[''"]https?://[^''"]*example\.com[^''"]*[''"]') { return $true }
+    if ($c -match '(?m)^\s*\$SacApiKey\s*=\s*[''"]sac_CHANGE_ME[''"]') { return $true }
+    if ($c -match '(?m)^\s*\$TelegramBotToken\s*=\s*[''"]YOUR_BOT_TOKEN[''"]') { return $true }
+    if ($c -match '(?m)^\s*\$TelegramChatID\s*=\s*[''"]YOUR_CHAT_ID[''"]') { return $true }
+    return $false
+}
+
 function Test-RdpMonitorSettingsNeedsSacBootstrap {
     param([string]$SettingsPath)
     $c = Get-RdpMonitorSettingsRaw -Path $SettingsPath
     if ([string]::IsNullOrWhiteSpace($c)) { return $true }
 
+    if (Test-RdpMonitorSettingsHasPlaceholderSecrets -SettingsPath $SettingsPath) { return $true }
+
     if ($c -notmatch '(?m)^\s*\$UseSAC\s*=') { return $true }
     if ($c -match '(?m)^\s*\$UseSAC\s*=\s*[''"]off[''"]') {
         if ($c -notmatch '(?m)^\s*\$SacApiKey\s*=\s*[''"]sac_[^''"]+[''"]') { return $true }
@@ -980,12 +994,8 @@ function Get-RdpMonitorSacBlockFromExample {
     if ($ex -match '(?ms)(#\s*---\s*Security Alert Center.*?)(?=\r?\n#\s*---|\z)') {
         return $Matches[1].TrimEnd()
     }
-    return @(
-        '# --- Security Alert Center (SAC) ---'
-        '$UseSAC = ''fallback'''
-        '$SacUrl = ''https://sac.example.com'''
-        '$SacApiKey = ''sac_CHANGE_ME'''
-    ) -join "`r`n"
+    Write-DeployLog "Предупреждение: в example нет блока Security Alert Center — patch SAC пропущен."
+    return $null
 }
 
 function Sync-RdpMonitorUseSacFallbackMode {
@@ -1023,8 +1033,10 @@ function Update-RdpMonitorSettingsSacBlockIfMissing {
 
     if ($c -match '(?m)^\s*\$UseSAC\s*=' -and $c -match '(?m)^\s*\$SacApiKey\s*=\s*[''"]sac_[^''"]+[''"]') {
         if ($c -notmatch '(?m)^\s*\$UseSAC\s*=\s*[''"]off[''"]') {
-            Write-DeployLog "login_monitor.settings.ps1: блок SAC уже задан, файл не меняем."
-            return $false
+            if (-not (Test-RdpMonitorSettingsHasPlaceholderSecrets -SettingsPath $LocalSettings)) {
+                Write-DeployLog "login_monitor.settings.ps1: блок SAC уже задан, файл не меняем."
+                return $false
+            }
         }
     }