feat: safe config parser without source (2.3.0-SAC)

Whitelist-based /etc/ssh-monitor.conf load; validate URLs/enums/CIDR; remove BACKUP_WEBHOOK_URL.

ssh-monitor-watchdog

@@ -42,41 +42,10 @@ send_telegram_raw() {
 	return 1
 }
 
-send_backup_webhook_raw() {
-	local message="$1"
-	if [ -z "${BACKUP_WEBHOOK_URL:-}" ]; then
-		return 1
-	fi
-	if ! command -v python3 >/dev/null 2>&1; then
-		return 1
-	fi
-	local plain="$message"
-	local payload
-	payload="$(BACKUP_MSG="$plain" python3 - <<'PY'
-import json, os
-print(json.dumps({"text": os.environ.get("BACKUP_MSG", "")}))
-PY
-)"
-	if curl -fsS -m 12 -X POST "$BACKUP_WEBHOOK_URL" \
-		-H "Content-Type: application/json" \
-		-d "$payload" >/dev/null 2>&1; then
-		return 0
-	fi
-	return 1
-}
-
 notify_send() {
 	local message="$1"
 	message="$(ssh_monitor_message_ensure_server_line "$message")"
-	if send_telegram_raw "$message"; then
-		return 0
-	fi
-	if send_backup_webhook_raw "$message"; then
-		write_log "WARN: Telegram недоступен, сообщение watchdog ушло в BACKUP_WEBHOOK_URL"
-		return 0
-	fi
-	write_log "WARN: watchdog: не удалось отправить уведомление"
-	return 1
+	send_telegram_raw "$message"
 }
 
 load_config() {
@@ -84,11 +53,7 @@ load_config() {
 		local _strict_peek
 		_strict_peek="$(ssh_monitor_config_peek CONFIG_STRICT_PERMS "$CONFIG_FILE" "0")"
 		ssh_monitor_check_config_file_perms "$CONFIG_FILE" "$_strict_peek" || true
-		# shellcheck disable=SC1090
-		source "$CONFIG_FILE"
-	fi
-	if [ -n "${BACKUP_WEBHOOK_URL:-}" ]; then
-		write_log "WARN: BACKUP_WEBHOOK_URL deprecated (legacy fallback); будет удалён в 2.3.x"
+		ssh_monitor_config_load_file "$CONFIG_FILE" || true
 	fi
 }