Summary

• add unit coverage for Failed none for illegal user ... legacy OpenSSH wording
• add syslog and journalctl fixture-matrix rows for the same wording
• update parser fixture matrix counts without changing parser behavior or detector surface

Validation

• cmake --build build --config Debug --target test_parser
• ctest --test-dir build -C Debug -R parser --output-on-failure
• cmake --build build --config Debug
• ctest --test-dir build -C Debug --output-on-failure
• git diff --check

Safety

• Fixture additions use example-host and 203.0.113.x documentation addresses only.
• No parser logic, event enum, or detector mapping changes.