feat(tools): add root-ssh-login tool to enable or disable root SSH password login

- add tools/root-ssh-login.sh with interactive menu, --enable/--disable/--status flags, and sshd drop-in config management
- register root-ssh-login in lxs.sh dispatch and tools/index.sh interactive menu
- document new tool in README.md command reference and project structure

README.md

@@ -52,6 +52,7 @@ lxs help                  # Show help
 | `lxs tool harden` | Baseline hardening: UFW + fail2ban + SSH key-only + unattended-upgrades |
 | `lxs tool root-password` | Change the root password (interactive or generated) |
 | `lxs tool update` | Update the server (apt update + upgrade + autoremove + autoclean) |
+| `lxs tool root-ssh-login` | Enable or disable root login over SSH with a password |
 
 ## Project structure
 
@@ -74,7 +75,8 @@ lxs/
     ├── server-benchmark.sh
     ├── harden.sh
     ├── root-password.sh
-    └── update-server.sh
+    ├── update-server.sh
+    └── root-ssh-login.sh
 ```
 
 After `lxs setup`, the full tree lives in `/usr/local/share/lxs/` and sub-scripts execute from disk. If `lxs.sh` is run without being installed (the one-liner mode), it falls back to downloading sub-scripts on demand.