Implement user login logging

docs/AGENT-API-AUTH.md

@@ -1,12 +1,16 @@
 # Agent API authentication
 
 Reference for the per-device signature gate on the agent-facing HTTP
-API. Four endpoints are gated:
+API. Five endpoints are gated:
 
 - `POST /api/heartbeat`
 - `POST /api/sysinfo`
 - `POST /api/unattended-password`
 - `POST /api/agent/exec-result` — managed-only (no legacy/unsigned path)
+- `POST /api/agent/login-event` — user-logon / logoff events observed
+  by the agent. Same TOFU lifecycle as heartbeat / sysinfo: stock
+  RustDesk doesn't post here at all, so in practice every caller is a
+  managed agent; the legacy/unsigned path is kept for symmetry.
 
 For the operator workflow — turning it on, the dashboard toggle, what
 happens when a managed agent is uninstalled — see the matching section