test/docs: RDP agent.lifecycle ingest and 422 notes

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_ingest.py

@@ -53,6 +53,23 @@ def test_ingest_duplicate_409(client, auth_headers):
     assert data["event_id"] == event_id
 
 
+def test_ingest_rdp_lifecycle_201(client, auth_headers):
+    event_id = str(uuid.uuid4())
+    payload = {
+        **VALID_EVENT,
+        "event_id": event_id,
+        "source": {"product": "rdp-login-monitor", "product_version": "1.2.11-SAC"},
+        "host": {"hostname": "K6A-DC3", "os_family": "windows"},
+        "type": "agent.lifecycle",
+        "title": "RDP login monitor started",
+        "summary": "Мониторинг запущен на K6A-DC3, версия 1.2.11-SAC",
+        "details": {"lifecycle": "started"},
+    }
+    r = client.post("/api/v1/events", json=payload, headers=auth_headers)
+    assert r.status_code == 201
+    assert r.json()["event_id"] == event_id
+
+
 def test_ingest_invalid_payload_422(client, auth_headers):
     r = client.post(
         "/api/v1/events",