refactor: harden install, extract shared lib, add seclog-diagnose - install.sh: remove || true from systemctl enable — fails fast on daemon error - install.sh: validate NTFY_URL reachability after config is set - install.sh: cleaner next-steps output - bin/seclog-lib.sh: new shared library with geo_lookup and show_active_connections - bin/seclog: source seclog-lib.sh, remove duplicated geo/connection logic - bin/ssh-login-notify.sh: source seclog-lib.sh, remove duplicated code - bin/seclog-diagnose: new diagnostic script — checks prereqs, config, ntfy, permissions, systemd - config/config.example: remove unused VERIFY_UPDATE_SIGNATURES option - #2