feat: per-host WinRM/SSH credentials override (0.5.17)

Allow host-level login/password for home/workgroup PCs while keeping global domain admins in Settings.

backend/app/services/rdg_winrm_actions.py

@@ -12,7 +12,7 @@ from app.models import AgentCommand, Event, Host
 from app.services.rdg_client_host import ClientWorkstationNotFoundError, resolve_client_workstation
 from app.services.rdg_display import event_supports_rdg_client_qwinsta
 from app.services.rdg_session_flap import event_internal_ip
-from app.services.win_admin_settings import get_effective_win_admin_config
+from app.services.win_admin_settings import get_effective_win_admin_for_host
 from app.services.winrm_connect import (
     WinRmCmdResult,
     run_winrm_logoff,
@@ -21,12 +21,17 @@ from app.services.winrm_connect import (
 )
 
 
-def _require_win_admin(db: Session):
-    cfg = get_effective_win_admin_config(db)
+def _require_win_admin(db: Session, host: Host | None = None):
+    if host is not None:
+        cfg = get_effective_win_admin_for_host(db, host)
+    else:
+        from app.services.win_admin_settings import get_effective_win_admin_config
+
+        cfg = get_effective_win_admin_config(db)
     if not cfg.configured:
         raise HTTPException(
             status_code=503,
-            detail="Windows domain admin is not configured (Settings or SAC_WIN_ADMIN_*)",
+            detail="Windows admin is not configured (host override or Settings → Windows)",
         )
     return cfg
 
@@ -93,8 +98,8 @@ def _persist_command(
 
 def execute_qwinsta_via_winrm(db: Session, event: Event, *, requested_by: str) -> AgentCommand:
     _require_rdg_client_qwinsta(db, event)
-    cfg = _require_win_admin(db)
     client_host = _resolve_client(db, event)
+    cfg = _require_win_admin(db, client_host)
 
     details = event.details if isinstance(event.details, dict) else {}
     user = details.get("user")
@@ -136,8 +141,8 @@ def execute_logoff_via_winrm(
     requested_by: str,
 ) -> AgentCommand:
     _require_rdg_client_qwinsta(db, event)
-    cfg = _require_win_admin(db)
     client_host = _resolve_client(db, event)
+    cfg = _require_win_admin(db, client_host)
 
     details = event.details if isinstance(event.details, dict) else {}
     user = details.get("user")