feat: close rdp.login.success on rdp.session.logoff (v0.5.12)

Ingest correlates direct RDP logoff with open login events on the same host and user. Terminate-session treats missing qwinsta as already logged off.

docs/agent-integration.md

@@ -185,6 +185,7 @@ Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000
 | 4624 успех | `rdp.login.success` | info |
 | 4625 неудача | `rdp.login.failed` | warning |
 | 4634 / 4647 выход (прямой RDP) | `rdp.session.logoff` | info |
+| RCM **20506** Shadow Control started | `rdp.shadow.control.started` | **warning** |
 | RCM **20507** Shadow Control stopped | `rdp.shadow.control.stopped` | **warning** |
 | RCM **20510** Shadow Control permission | `rdp.shadow.control.permission` | **warning** |
 | WinRM **91** inbound shell (Enter-PSSession) | `winrm.session.started` | **warning** |

docs/event-schema-v1.json

@@ -94,6 +94,7 @@
         "session.logind.new",
         "rdp.login.success",
         "rdp.login.failed",
+        "rdp.session.logoff",
         "rdp.shadow.control.started",
         "rdp.shadow.control.stopped",
         "rdp.shadow.control.permission",