Add Uptime Kuma push alerts for SSH logins with public-key auth context

[Copilot]

This PR implements SSH login notifications end-to-end: each opened SSH session now emits a Uptime Kuma push event, including details of the public key used when available. The goal is to alert on every SSH connection, not just service health.

• Terraform: dedicated SSH login push monitor

  • Added tofu/pangolin_config/uptime_ssh_login.tf
  • Provisions uptimekuma_monitor_push.ssh_login
  • Exposes output "uptime_ssh_login_url" for Ansible consumption

• Ansible wiring: load monitor URL from shared tfstate

  • Updated ansible/00-setup.yaml to read pangolin_config.tfstate and set:
    • ssh_login_notification_healthcheck_url
  • Registers the new ssh_login_notification role in base host setup (all,!backups)

• Host-level SSH notification hook (PAM + sshd)

  • New role: ansible/roles/ssh_login_notification
    • Installs /usr/local/bin/ssh-login-notify
    • Enables ExposeAuthInfo yes in sshd (/etc/ssh/sshd_config.d/50-expose-auth-info.conf)
    • Adds PAM session hook in /etc/pam.d/sshd via pam_exec
  • Script sends Uptime Kuma push with login metadata:
    • user, source/destination IP:port, auth method
    • public key type + fingerprint when SSH_USER_AUTH is present

# /etc/pam.d/sshd
session optional pam_exec.so seteuid /usr/local/bin/ssh-login-notify

• Fixes recevoir notification lors d'un connexion ssh #451