feat: close rdp.login.success on rdp.session.logoff (v0.5.12)

Ingest correlates direct RDP logoff with open login events on the same host and user. Terminate-session treats missing qwinsta as already logged off.

backend/tests/test_host_sessions.py

@@ -8,6 +8,7 @@ from app.services.host_sessions import (
     event_session_terminated,
     event_supports_session_terminate,
     filter_logind_session_rows,
+    filter_windows_sessions_for_user,
     mark_event_session_terminated,
     parse_loginctl_sessions,
     parse_loginctl_sessions_json,
@@ -94,6 +95,48 @@ def test_event_login_user_without_orm_actor_user_attr():
     assert _event_login_user(event) == "papatramp"
 
 
+def test_filter_windows_sessions_for_user_matches_domain():
+    rows = [
+        HostSessionRow(session_id="2", user="B26\\papatramp", state="Active"),
+        HostSessionRow(session_id="3", user="B26\\alice", state="Active"),
+    ]
+    matched = filter_windows_sessions_for_user(rows, "papatramp")
+    assert len(matched) == 1
+    assert matched[0].session_id == "2"
+
+
+def test_terminate_session_for_event_windows_already_logged_off(monkeypatch):
+    host = SimpleNamespace(
+        os_family="windows",
+        product="rdp-login-monitor",
+        hostname="BIV-PC",
+        ipv4="192.168.165.39",
+        display_name=None,
+        inventory={},
+    )
+    event = SimpleNamespace(
+        type="rdp.login.success",
+        details={"user": "papatramp"},
+        host=host,
+    )
+
+    def fake_list(_host, _cfg):
+        return [], WinRmCmdResult(ok=True, message="ok", target="BIV-PC", stdout="SESSIONNAME USERNAME ID STATE")
+
+    monkeypatch.setattr(
+        "app.services.host_sessions.list_windows_sessions",
+        fake_list,
+    )
+
+    result = terminate_session_for_event(
+        event,
+        linux_cfg=LinuxAdminConfig(user="", password="", source="test"),
+        win_cfg=WinAdminConfig(user="B26\\admin", password="x", source="test"),
+    )
+    assert result.ok is True
+    assert "уже вышел" in result.message
+
+
 def test_terminate_session_for_event_windows_no_actor_user_attr(monkeypatch):
     host = SimpleNamespace(
         os_family="windows",