docs: refresh README; allow monitor JWT for RDG qwinsta/logoff (0.20.6)

Update platform docs for current features; Seaca and web operators with
monitor role can trigger WinRM actions via SAC API.

backend/app/services/rdg_winrm_actions.py

@@ -10,7 +10,7 @@ from sqlalchemy.orm import Session
 
 from app.models import AgentCommand, Event, Host
 from app.services.rdg_client_host import ClientWorkstationNotFoundError, resolve_client_workstation
-from app.services.rdg_session_flap import event_has_rdg_flap, event_internal_ip
+from app.services.rdg_session_flap import event_has_rdg_flap, event_internal_ip, resolve_rdg_flap_summary
 from app.services.win_admin_settings import get_effective_win_admin_config
 from app.services.winrm_connect import (
     WinRmCmdResult,
@@ -30,9 +30,13 @@ def _require_win_admin(db: Session):
     return cfg
 
 
-def _require_rdg_flap(event: Event) -> None:
-    if not event_has_rdg_flap(event):
-        raise HTTPException(status_code=400, detail="Event is not flagged as RDG session flap")
+def _require_rdg_flap(db: Session, event: Event) -> None:
+    flap, _, qwinsta_id = resolve_rdg_flap_summary(db, event)
+    if flap and qwinsta_id == event.id:
+        return
+    if event_has_rdg_flap(event):
+        return
+    raise HTTPException(status_code=400, detail="Event is not flagged as RDG session flap")
 
 
 def _resolve_client(db: Session, event: Event) -> Host:
@@ -87,7 +91,7 @@ def _persist_command(
 
 
 def execute_qwinsta_via_winrm(db: Session, event: Event, *, requested_by: str) -> AgentCommand:
-    _require_rdg_flap(event)
+    _require_rdg_flap(db, event)
     cfg = _require_win_admin(db)
     client_host = _resolve_client(db, event)
 
@@ -130,7 +134,7 @@ def execute_logoff_via_winrm(
     session_id: int,
     requested_by: str,
 ) -> AgentCommand:
-    _require_rdg_flap(event)
+    _require_rdg_flap(db, event)
     cfg = _require_win_admin(db)
     client_host = _resolve_client(db, event)