feat: per-host WinRM/SSH credentials override (0.5.17)

Allow host-level login/password for home/workgroup PCs while keeping global domain admins in Settings.

backend/app/services/agent_update.py

@@ -20,7 +20,7 @@ from app.services.agent_version import (
     host_version_outdated,
     latest_agent_versions_by_product,
 )
-from app.services.linux_admin_settings import get_effective_linux_admin_config
+from app.services.linux_admin_settings import get_effective_linux_admin_for_host
 from app.services.ssh_connect import (
     HostNotLinuxError,
     HostTargetMissingError,
@@ -28,7 +28,7 @@ from app.services.ssh_connect import (
     iter_ssh_targets,
     run_ssh_monitor_update,
 )
-from app.services.win_admin_settings import get_effective_win_admin_config
+from app.services.win_admin_settings import get_effective_win_admin_for_host
 from app.services.winrm_connect import (
     HostNotWindowsError,
     HostTargetMissingError as WinRmHostTargetMissingError,
@@ -249,7 +249,7 @@ def execute_agent_update_fallback(db: Session, host: Host) -> AgentUpdateFallbac
     product = (host.product or "").strip()
 
     if product == PRODUCT_SSH or is_linux_host(host):
-        linux_cfg = get_effective_linux_admin_config(db)
+        linux_cfg = get_effective_linux_admin_for_host(db, host)
         agent_cfg = get_effective_agent_update_config(db)
         repo_url = (agent_cfg.ssh_git_repo_url or "").strip() or None
         branch = (agent_cfg.git_branch or "main").strip() or "main"
@@ -260,7 +260,7 @@ def execute_agent_update_fallback(db: Session, host: Host) -> AgentUpdateFallbac
             git_branch=branch,
         )
     elif product == PRODUCT_RDP or is_windows_host(host):
-        win_cfg = get_effective_win_admin_config(db)
+        win_cfg = get_effective_win_admin_for_host(db, host)
         result = run_windows_agent_update_fallback(
             host,
             win_cfg,