feat: Windows admin in Settings UI and WinRM host test (0.10.1)

Store domain admin in ui_settings (DB overrides env); qwinsta/logoff use effective config.
Host card: POST /hosts/{id}/actions/winrm-test via pywinrm.

backend/app/services/agent_commands.py

@@ -12,20 +12,20 @@ from sqlalchemy.orm import Session
 from app.config import get_settings
 from app.models import AgentCommand, Event, Host
 from app.services.rdg_session_flap import event_has_rdg_flap
+from app.services.win_admin_settings import get_effective_win_admin_config
 
 
 def _win_admin_configured() -> bool:
-    settings = get_settings()
-    return bool(settings.sac_win_admin_user.strip() and settings.sac_win_admin_password.strip())
+    return get_effective_win_admin_config().configured
 
 
 def win_admin_run_as() -> dict[str, str] | None:
-    if not _win_admin_configured():
+    cfg = get_effective_win_admin_config()
+    if not cfg.configured:
         return None
-    settings = get_settings()
     return {
-        "user": settings.sac_win_admin_user.strip(),
-        "password": settings.sac_win_admin_password,
+        "user": cfg.user,
+        "password": cfg.password,
     }
 
 
@@ -53,7 +53,7 @@ def queue_qwinsta(db: Session, event: Event, *, requested_by: str) -> AgentComma
     if not _win_admin_configured():
         raise HTTPException(
             status_code=503,
-            detail="SAC_WIN_ADMIN_USER / SAC_WIN_ADMIN_PASSWORD not configured",
+            detail="Windows domain admin is not configured (Settings or SAC_WIN_ADMIN_*)",
         )
     details = event.details if isinstance(event.details, dict) else {}
     user = details.get("user")
@@ -83,7 +83,7 @@ def queue_logoff(
     if not _win_admin_configured():
         raise HTTPException(
             status_code=503,
-            detail="SAC_WIN_ADMIN_USER / SAC_WIN_ADMIN_PASSWORD not configured",
+            detail="Windows domain admin is not configured (Settings or SAC_WIN_ADMIN_*)",
         )
     cmd = AgentCommand(
         command_uuid=str(uuid.uuid4()),