feat: SAC support smb.admin_share.access events from RDP agent

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/agent-integration.md

@@ -187,6 +187,7 @@ Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000
 | RCM **20510** Shadow Control permission | `rdp.shadow.control.permission` | **warning** |
 | WinRM **91** inbound shell (Enter-PSSession) | `winrm.session.started` | **warning** |
 | Security **5140** admin share (`C$`, `ADMIN$`) | `smb.admin_share.access` | **warning** |
+| 4648 | `auth.explicit.credentials` | warning |
 | RD Gateway 302 | `rdg.connection.success` | info |
 | RD Gateway 303 | `rdg.connection.failed` | warning |
 | Старт/стоп | `agent.lifecycle` | info |
@@ -198,10 +199,11 @@ Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000
 - Shadow: `shadower_user`, `target_user`, `session_id`, `shadow_mode`, `shadow_action`
 - WinRM: `source_ip`, `resource_uri`, `transport`
 - Admin share 5140: `share_name`, `share_path`, `relative_target`, `access_mask`
+- `gateway_target`, `gateway_error_code`
 - `filtered_out`, `filter_reason`
 
 **Переключатели в `login_monitor.settings.ps1` (≥ 1.2.23-SAC):** `$EnableRcmShadowControlMonitoring`, `$EnableWinRmInboundMonitoring`, `$EnableAdminShareMonitoring` (по умолчанию `1`; Security **5140**, audit File Share). Подавление: `ignore.lst` с префиксами `shadow:`, `winrm:`, `smb:` / `5140:`.
-
+
 ---
 
 ## 3.3. Человекочитаемое имя хоста (`host.display_name`)