feat: HTML Telegram templates for RDP/SSH events (notif-30)

Agent-style messages from event details, parse_mode HTML, templates for
login/sudo/RDG and problems; unit tests.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_telegram_templates.py

@@ -0,0 +1,81 @@
+"""Telegram HTML templates (notif-30)."""
+
+from datetime import datetime, timezone
+
+from app.models import Event, Host
+from app.services.telegram_templates import format_event_telegram_html, format_rdp_login_html, html_escape
+
+
+def test_html_escape_special_chars():
+    assert html_escape("a<b>&") == "a&lt;b&gt;&amp;"
+
+
+def test_rdp_failed_template_includes_user_ip_logon():
+    host = Host(hostname="K6A-DC3", display_name="UNMS Kalina", os_family="windows")
+    event = Event(
+        event_id="00000000-0000-4000-8000-000000000501",
+        host_id=1,
+        host=host,
+        occurred_at=datetime(2026, 5, 29, 10, 30, 0, tzinfo=timezone.utc),
+        category="auth",
+        type="rdp.login.failed",
+        severity="warning",
+        title="RDP login failed",
+        summary="4625 user from 10.0.0.5",
+        details={
+            "user": "DOMAIN\\admin",
+            "ip_address": "10.0.0.5",
+            "logon_type": 10,
+            "event_id_windows": 4625,
+            "workstation_name": "CLIENT01",
+        },
+        payload={},
+    )
+    text = format_rdp_login_html(event)
+    assert "НЕУДАЧНАЯ" in text
+    assert "DOMAIN\\admin" in text or "DOMAIN" in text
+    assert "10.0.0.5" in text
+    assert "Удаленный интерактивный" in text
+    assert "(10)" in text
+    assert "UNMS Kalina" in text
+    assert "CLIENT01" in text
+    assert "4625" in text
+    assert "<b>" in text
+
+
+def test_rdp_success_template():
+    event = Event(
+        event_id="00000000-0000-4000-8000-000000000502",
+        host_id=1,
+        occurred_at=datetime(2026, 5, 29, 11, 0, tzinfo=timezone.utc),
+        category="auth",
+        type="rdp.login.success",
+        severity="info",
+        title="ok",
+        summary="ok",
+        details={"user": "u1", "ip_address": "1.2.3.4", "logon_type": 3},
+        payload={},
+    )
+    text = format_event_telegram_html(event)
+    assert "УСПЕШНЫЙ" in text
+    assert "Сеть/RDP" in text
+
+
+def test_ssh_failed_template():
+    event = Event(
+        event_id="00000000-0000-4000-8000-000000000503",
+        host_id=1,
+        occurred_at=datetime(2026, 5, 29, 12, 0, tzinfo=timezone.utc),
+        category="auth",
+        type="ssh.login.failed",
+        severity="warning",
+        title="ssh fail",
+        summary="fail",
+        details={"user": "root", "source_ip": "10.10.36.9", "port": 22, "attempt_number": 3, "max_attempts": 5},
+        payload={},
+    )
+    text = format_event_telegram_html(event)
+    assert "SSH" in text
+    assert "root" in text
+    assert "10.10.36.9" in text
+    assert "3 / 5" in text