feat: per-host WinRM/SSH credentials override (0.5.17)

Allow host-level login/password for home/workgroup PCs while keeping global domain admins in Settings.

backend/tests/test_host_mgmt_credentials.py

@@ -0,0 +1,64 @@
+"""Per-host management credential override."""
+
+from app.models.host import Host
+from app.services.linux_admin_settings import get_effective_linux_admin_for_host
+from app.services.win_admin_settings import get_effective_win_admin_for_host
+from app.services.host_mgmt_credentials import get_host_mgmt_access_view, upsert_host_mgmt_credentials
+
+
+def test_win_admin_for_host_prefers_override(db_session):
+    host = Host(
+        hostname="HOME-PC",
+        os_family="windows",
+        product="rdp-login-monitor",
+        mgmt_user=".\\Admin",
+        mgmt_password="local-secret",
+    )
+    db_session.add(host)
+    db_session.commit()
+    db_session.refresh(host)
+
+    cfg = get_effective_win_admin_for_host(db_session, host)
+    assert cfg.configured is True
+    assert cfg.source == "host"
+    assert cfg.user == ".\\Admin"
+    assert cfg.password == "local-secret"
+
+
+def test_linux_admin_for_host_prefers_override(db_session):
+    host = Host(
+        hostname="homeserver",
+        os_family="linux",
+        product="ssh-monitor",
+        mgmt_user="deploy",
+        mgmt_password="ssh-pass",
+    )
+    db_session.add(host)
+    db_session.commit()
+    db_session.refresh(host)
+
+    cfg = get_effective_linux_admin_for_host(db_session, host)
+    assert cfg.source == "host"
+    assert cfg.user == "deploy"
+
+
+def test_upsert_and_clear_host_access(db_session):
+    host = Host(hostname="box", os_family="windows", product="rdp-login-monitor")
+    db_session.add(host)
+    db_session.commit()
+    db_session.refresh(host)
+
+    view = upsert_host_mgmt_credentials(
+        db_session,
+        host,
+        user="HOME\\user",
+        password="secret123",
+    )
+    assert view.has_override is True
+    assert view.password_set is True
+    assert view.user == "HOME\\user"
+
+    cleared = upsert_host_mgmt_credentials(db_session, host, clear=True)
+    assert cleared.has_override is False
+    assert cleared.password_set is False
+    assert get_host_mgmt_access_view(db_session, host).user is None