fix: POST ingest to /api/v1/events when SAC_URL is host root

Health already used sac_base_url(); ingest used raw SAC_URL and got
HTTP 405 when config had only https://host without /api/v1/events.

sac-client.sh

@@ -17,6 +17,14 @@ sac_base_url() {
  printf '%s' "${url%/}"
 }
 
+# URL ingest (POST): всегда .../api/v1/events, даже если в конфиге указан только хост
+sac_ingest_url() {
+ local base
+ base="$(sac_base_url)"
+ [ -n "$base" ] || return 1
+ printf '%s/api/v1/events' "$base"
+}
+
 sac_agent_instance_id() {
  local id_file="${SAC_AGENT_ID_FILE:-/var/lib/ssh-monitor/agent_instance_id}"
  local dir
@@ -145,7 +153,7 @@ PY
  resp="$(mktemp)"
  printf '%s' "$payload" >"$tmp"
  http_code="$(curl -sS -o "$resp" -w '%{http_code}' \
-  -X POST "${SAC_URL}" \
+  -X POST "$(sac_ingest_url)" \
   -H "Authorization: Bearer ${SAC_API_KEY}" \
   -H "Content-Type: application/json" \
   -H "Idempotency-Key: ${event_id}" \
@@ -220,6 +228,9 @@ run_check_sac() {
  printf 'Проверка SAC (ssh-monitor)\n'
  printf 'UseSAC=%s\n' "${UseSAC:-off}"
  printf 'SAC_URL=%s\n' "${SAC_URL:-}"
+ if sac_is_configured; then
+  printf 'SAC ingest URL=%s\n' "$(sac_ingest_url)"
+ fi
  if ! sac_is_configured; then
  printf 'SAC: SAC_URL или SAC_API_KEY не заданы\n' >&2
  return 1

ssh-monitor.conf.example

@@ -28,7 +28,8 @@ NOTIFY_ORDER=""
 # --- Security Alert Center (SAC) ---
 # off | exclusive | dual | fallback — см. docs в security-alert-center (agent-integration.md)
 UseSAC="off"
-SAC_URL="https://sac.kalinamall.ru/api/v1/events"
+# Допустимо и корень хоста (ingest всё равно пойдёт на /api/v1/events):
+SAC_URL="https://sac.kalinamall.ru"
 SAC_API_KEY=""
 SAC_SPOOL_DIR="/var/lib/ssh-monitor/sac-spool"
 SAC_TIMEOUT_SEC="12"