feat: Windows admin in Settings UI and WinRM host test (0.10.1)

Store domain admin in ui_settings (DB overrides env); qwinsta/logoff use effective config.
Host card: POST /hosts/{id}/actions/winrm-test via pywinrm.

backend/tests/test_win_admin_settings.py

@@ -0,0 +1,93 @@
+"""Win admin settings and WinRM host test."""
+
+from unittest.mock import patch
+
+from app.models.ui_settings import UI_SETTINGS_ROW_ID, UiSettings
+
+
+def test_get_win_admin_settings_env_default(jwt_headers, client, monkeypatch):
+    monkeypatch.setenv("SAC_WIN_ADMIN_USER", "")
+    monkeypatch.setenv("SAC_WIN_ADMIN_PASSWORD", "")
+    from app.config import get_settings
+
+    get_settings.cache_clear()
+
+    response = client.get("/api/v1/settings/win-admin", headers=jwt_headers)
+    assert response.status_code == 200
+    body = response.json()
+    assert body["configured"] is False
+    assert body["source"] == "env"
+
+
+def test_put_win_admin_settings_persists(jwt_headers, client, db_session, monkeypatch):
+    monkeypatch.setenv("SAC_WIN_ADMIN_USER", "")
+    monkeypatch.setenv("SAC_WIN_ADMIN_PASSWORD", "")
+    from app.config import get_settings
+
+    get_settings.cache_clear()
+
+    response = client.put(
+        "/api/v1/settings/win-admin",
+        headers=jwt_headers,
+        json={"user": r"B26\papatramp", "password": "secret-pass"},
+    )
+    assert response.status_code == 200
+    body = response.json()
+    assert body["configured"] is True
+    assert body["user"] == r"B26\papatramp"
+    assert body["source"] == "db"
+    assert body["password_hint"]
+
+    row = db_session.get(UiSettings, UI_SETTINGS_ROW_ID)
+    assert row is not None
+    assert row.win_admin_user == r"B26\papatramp"
+    assert row.win_admin_password == "secret-pass"
+
+
+def test_host_winrm_test_requires_admin(jwt_monitor_headers, client):
+    response = client.post("/api/v1/hosts/1/actions/winrm-test", headers=jwt_monitor_headers)
+    assert response.status_code == 403
+
+
+def test_host_winrm_test_not_found(jwt_headers, client):
+    response = client.post("/api/v1/hosts/99999/actions/winrm-test", headers=jwt_headers)
+    assert response.status_code == 404
+
+
+def test_host_winrm_test_success(jwt_headers, client, db_session, monkeypatch):
+    monkeypatch.setenv("SAC_WIN_ADMIN_USER", r"B26\admin")
+    monkeypatch.setenv("SAC_WIN_ADMIN_PASSWORD", "pw")
+    from app.config import get_settings
+
+    get_settings.cache_clear()
+
+    from app.models import Host
+    from app.services.winrm_connect import WinRmTestResult
+
+    host = Host(
+        hostname="PC01",
+        os_family="windows",
+        product="rdp-login-monitor",
+        ipv4="192.168.1.10",
+    )
+    db_session.add(host)
+    db_session.commit()
+    db_session.refresh(host)
+
+    with patch("app.api.v1.hosts.test_winrm_connection") as mock_test:
+        mock_test.return_value = WinRmTestResult(
+            ok=True,
+            message="WinRM OK, hostname=PC01",
+            target="192.168.1.10",
+            hostname="PC01",
+        )
+        response = client.post(
+            f"/api/v1/hosts/{host.id}/actions/winrm-test",
+            headers=jwt_headers,
+        )
+
+    assert response.status_code == 200
+    body = response.json()
+    assert body["ok"] is True
+    assert body["hostname"] == "PC01"
+    assert body["target"] == "192.168.1.10"