feat: RDP flap auto-disconnect and hide break button after reconnect (0.4.10)

Add optional auto logoff of stuck sessions on RDG flap and direct RDP failure. Hide the RDS break button on old flap 302 when the user later reconnects or the workstation session is closed.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_rdg_session_flap.py

@@ -263,6 +263,51 @@ def test_rdg_qwinsta_enabled_while_session_open(db_session, rdg_settings):
     assert event_to_summary(start, db_session).rdg_qwinsta_enabled is True
 
 
+def test_rdg_qwinsta_disabled_on_flap_302_after_later_success(db_session, rdg_settings):
+    t0 = datetime.now(timezone.utc)
+    user = r"B26\m.semenova"
+    details = {"user": user, "internal_ip": "192.168.164.45"}
+
+    flap_start = _ingest(
+        db_session,
+        t0,
+        type="rdg.connection.success",
+        category="auth",
+        severity="warning",
+        title="302",
+        summary="302",
+        details=details,
+    )
+    flap_end = _ingest(
+        db_session,
+        t0 + timedelta(seconds=5),
+        type="rdg.connection.disconnected",
+        category="auth",
+        severity="info",
+        title="303",
+        summary="303",
+        details=details,
+    )
+    evaluate_rdg_session_flap(db_session, flap_end)
+    db_session.flush()
+
+    assert resolve_rdg_qwinsta_enabled(db_session, flap_start) is True
+
+    _ingest(
+        db_session,
+        t0 + timedelta(minutes=2, seconds=44),
+        type="rdg.connection.success",
+        category="auth",
+        severity="warning",
+        title="302",
+        summary="302",
+        details=details,
+    )
+
+    assert resolve_rdg_qwinsta_enabled(db_session, flap_start) is False
+    assert event_to_summary(flap_start, db_session).rdg_qwinsta_enabled is False
+
+
 def test_rdg_qwinsta_stays_enabled_when_unrelated_303_without_internal_ip(db_session, rdg_settings):
     t0 = datetime.now(timezone.utc)
     user = "B26\\khodasevich"