feat: RDG session flap rule, qwinsta/logoff queue and dashboard UI (0.9.13)

Detect 302→303 within 1–10s, Problem with 30s dedup, rdg_flap flag.
Agent command poll API, admin qwinsta/logoff from Overview. Migration 016.

backend/app/config.py

@@ -102,6 +102,15 @@ class Settings(BaseSettings):
     sac_privilege_spike_window_minutes: int = 10
     sac_privilege_spike_threshold: int = 10
 
+    # rule:rdg_session_flap — RD Gateway 302→303 within window
+    sac_rdg_flap_window_min_sec: int = 1
+    sac_rdg_flap_window_max_sec: int = 10
+    sac_rdg_flap_dedup_sec: int = 30
+
+    # Windows admin for agent qwinsta/logoff (domain-wide)
+    sac_win_admin_user: str = ""
+    sac_win_admin_password: str = ""
+
     # Retention (app.jobs.retention / systemd timer)
     sac_events_retention_days: int = 90
     sac_problems_retention_days: int = 180