feat: Telegram templates for RDS shadow and WinRM session events

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/agent-integration.md

@@ -183,6 +183,10 @@ Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000
 | 4624 успех | `rdp.login.success` | info |
 | 4625 неудача | `rdp.login.failed` | warning |
 | RCM **20506** Shadow Control started | `rdp.shadow.control.started` | **warning** |
+| RCM **20507** Shadow Control stopped | `rdp.shadow.control.stopped` | **warning** |
+| RCM **20510** Shadow Control permission | `rdp.shadow.control.permission` | **warning** |
+| WinRM **91** inbound shell (Enter-PSSession) | `winrm.session.started` | **warning** |
+| 4648 | `auth.explicit.credentials` | warning |
 | RD Gateway 302 | `rdg.connection.success` | info |
 | RD Gateway 303 | `rdg.connection.failed` | warning |
 | Старт/стоп | `agent.lifecycle` | info |
@@ -192,9 +196,13 @@ Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000
 
 - `event_id_windows`, `logon_type`, `ip_address`, `workstation_name`
 - Shadow: `shadower_user`, `target_user`, `session_id`, `shadow_mode`, `shadow_action`
+- WinRM: `source_ip`, `resource_uri`, `transport`
+- `gateway_target`, `gateway_error_code`
 - `filtered_out`, `filter_reason`
 
 **Переключатели в `login_monitor.settings.ps1` (≥ 1.2.23-SAC):** `$EnableRcmShadowControlMonitoring`, `$EnableWinRmInboundMonitoring` (по умолчанию `1`). Подавление: `ignore.lst` с префиксами `shadow:` и `winrm:`.
+
+---
 
 ## 3.3. Человекочитаемое имя хоста (`host.display_name`)