fix: event terminate-session 500 on rdp.login.success (0.3.7)

Use extract_event_actor_user instead of missing ORM field; map WinRM/SSH errors to HTTP 400.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/services/host_sessions.py

@@ -7,6 +7,7 @@ import re
 from dataclasses import dataclass
 
 from app.models import Event, Host
+from app.services.event_actor_user import extract_event_actor_user
 from app.services.linux_admin_settings import LinuxAdminConfig
 from app.services.ssh_connect import (
     HostNotLinuxError as SshHostNotLinuxError,
@@ -69,6 +70,13 @@ def _details_dict(event: Event) -> dict:
     return raw if isinstance(raw, dict) else {}
 
 
+def _event_login_user(event: Event) -> str:
+    actor = extract_event_actor_user(event.type, event.details)
+    if actor:
+        return actor.strip()
+    return str(_details_dict(event).get("user") or "").strip()
+
+
 def event_session_id(event: Event) -> str | None:
     details = _details_dict(event)
     for key in ("session_id", "sid"):
@@ -422,7 +430,7 @@ def terminate_session_for_event(
     sid = (session_id or event_session_id(event) or "").strip()
     if is_linux_host(host):
         if not sid:
-            user = (event.actor_user or _details_dict(event).get("user") or "").strip()
+            user = _event_login_user(event)
             if user:
                 return _terminate_linux_user_sessions(host, linux_cfg, user)
             raise ValueError("session_id is required for this event")
@@ -430,7 +438,7 @@ def terminate_session_for_event(
 
     if is_windows_host(host):
         if not sid:
-            user = (event.actor_user or _details_dict(event).get("user") or "").strip()
+            user = _event_login_user(event)
             sessions, qwinsta = list_windows_sessions(host, win_cfg)
             if not qwinsta or not qwinsta.ok:
                 raise ValueError(qwinsta.message if qwinsta else "qwinsta failed")