fix: POST ingest to /api/v1/events when SAC_URL is host root

Health already used sac_base_url(); ingest used raw SAC_URL and got
HTTP 405 when config had only https://host without /api/v1/events.

ssh-monitor.conf.example

@@ -28,7 +28,8 @@ NOTIFY_ORDER=""
 # --- Security Alert Center (SAC) ---
 # off | exclusive | dual | fallback — см. docs в security-alert-center (agent-integration.md)
 UseSAC="off"
-SAC_URL="https://sac.kalinamall.ru/api/v1/events"
+# Допустимо и корень хоста (ingest всё равно пойдёт на /api/v1/events):
+SAC_URL="https://sac.kalinamall.ru"
 SAC_API_KEY=""
 SAC_SPOOL_DIR="/var/lib/ssh-monitor/sac-spool"
 SAC_TIMEOUT_SEC="12"