feat: per-host WinRM/SSH credentials override (0.5.17)

Allow host-level login/password for home/workgroup PCs while keeping global domain admins in Settings.

backend/app/services/win_admin_settings.py

@@ -1,4 +1,4 @@
-"""Effective Windows domain admin credentials (DB overrides env)."""
+"""Effective Windows domain admin credentials (host → DB → env)."""
 
 from __future__ import annotations
 
@@ -7,6 +7,7 @@ from dataclasses import dataclass
 from sqlalchemy.orm import Session
 
 from app.config import get_settings
+from app.models.host import Host
 from app.models.ui_settings import UI_SETTINGS_ROW_ID, UiSettings
 
 
@@ -14,7 +15,7 @@ from app.models.ui_settings import UI_SETTINGS_ROW_ID, UiSettings
 class WinAdminConfig:
     user: str
     password: str
-    source: str  # env | db
+    source: str  # host | env | db
 
     @property
     def configured(self) -> bool:
@@ -92,3 +93,17 @@ def upsert_win_admin_settings(
     db.commit()
     db.refresh(row)
     return get_effective_win_admin_config(db)
+
+
+def get_effective_win_admin_for_host(db: Session, host: Host) -> WinAdminConfig:
+    """Prefer per-host mgmt_* when both user and password are set; else global Settings/env."""
+    host_user = normalize_win_admin_user((host.mgmt_user or "").strip())
+    host_password = (host.mgmt_password or "").strip()
+    if host_user and host_password:
+        return WinAdminConfig(user=host_user, password=host_password, source="host")
+
+    global_cfg = get_effective_win_admin_config(db)
+    # Allow host to override only the username, still using global password (rare).
+    if host_user and global_cfg.password.strip():
+        return WinAdminConfig(user=host_user, password=global_cfg.password, source="host")
+    return global_cfg