fix: event terminate-session 500 on rdp.login.success (0.3.7)

Use extract_event_actor_user instead of missing ORM field; map WinRM/SSH errors to HTTP 400.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/api/v1/events.py

@@ -26,7 +26,12 @@ from app.services.host_sessions import (
     terminate_session_for_event,
 )
 from app.services.linux_admin_settings import get_effective_linux_admin_config
+from app.services.ssh_connect import (
+    HostNotLinuxError as SshHostNotLinuxError,
+    HostTargetMissingError as SshHostTargetMissingError,
+)
 from app.services.win_admin_settings import get_effective_win_admin_config
+from app.services.winrm_connect import HostNotWindowsError, HostTargetMissingError
 from app.services.ingest import ingest_event
 from app.services.event_summary import event_to_summary
 from app.services.event_type_visibility import get_hidden_event_types, visibility_type_filter
@@ -263,6 +268,14 @@ def post_event_terminate_session(
         )
     except ValueError as exc:
         raise HTTPException(status_code=400, detail=str(exc)) from exc
+    except HostNotWindowsError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+    except HostTargetMissingError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+    except SshHostNotLinuxError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+    except SshHostTargetMissingError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
 
     if hasattr(result, "exit_code"):
         return EventSessionTerminateResponse(