Feature/linux user auditor

[JocLRojas]

What this PR does

Extends the User Auditor feature — until now it only tracked Active Directory users from Windows event logs — to also track user accounts on Linux hosts. The same page, the same API, the same table, but now Windows and Linux user lifecycle events (create, delete, login, session activity) coexist in the same inventory with a source field that tells them apart.

Plugin changes

• The plugin now dispatches events by their dataType: Windows events still flow through the same code path as before (zero regression), and Linux events are routed to new handlers.
• Linux user create/delete events come from journald useradd/userdel messages. Login and session events come from auditd USER_LOGIN and USER_START. The plugin maintains a Linux-specific cache, flushes to the backend every 60 seconds just like the Windows path, and filters out system accounts (uid < 1000, auid=unset, etc).
• When a Linux auditd event arrives before the plugin has learned the host's machine-id (which only appears in journald), a provisional row is created and merged later once machine-id is known, via the new resolve endpoint.
• Auditd sometimes emits the same event twice with different timestamps but the same sequence number. The plugin now deduplicates these with a bounded in-memory set (10k entries, 5-minute TTL).
• On startup, the plugin seeds its cache from the backend twice — once for Windows rows and once for Linux rows — so restarts do not lose state.

Why this change

Two motivations, one blocking the other:

1. Feature request: extend the User Auditor to Linux hosts. Every Linux endpoint monitored by UTMStack already streams auditd and journald events through the pipeline, but the plugin was ignoring them entirely. Operators currently have no way to audit Linux user lifecycles from the unified inventory that works for their Windows fleet.
2. Bug found while validating the feature: when testing on the dev environment, no rows appeared in the User Auditor UI even for Windows, despite events reaching the pipeline. Investigation traced the problem to the manager-only guard described above. That fix is included here because without it the Linux feature would also fail on any event routed to the worker container.

Referenced issue

N/A

[github-actions]

🛑 AI review — Sensitive area, extra care recommended

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. Review carefully before merging.

🛑 architecture (gemini-3-flash-lite) — high/critical — please review

Summary: Introduces new database migrations altering schema/indexes and modifies plugin/backend audit contracts.

• high backend/migrations/000002_linux_user_auditor.up.sql:1 — Contains database migration changes (migration.go or SQL migration files), which require a Tier 3 designation per architectural guidelines.

✅ bugs (gemini-3-flash-lite) — clean

Summary: Linux user audit expansion adds partial unique indexes, repository upsert handling, and plugin event processing cleanly.

No findings.

🛑 security (gemini-3-flash-lite) — high/critical — please review

Summary: Introduces new database migration paths, internal gRPC/HTTP resolution endpoints, and plugin logic touching core authentication and asset inventory tracking.

No findings.

🔴 go-deps — pending updates

🔍 Discovered 27 Go projects

📦 Dependencies with updates available:

  📁 ./agent-manager:
     - google.golang.org/grpc: v1.82.1 → v1.83.0
     - gorm.io/driver/postgres: v1.6.0 → v1.6.2

  📁 ./plugins/inputs:
     - google.golang.org/grpc: v1.82.1 → v1.83.0

  📁 ./collectors/forwarder:
     - google.golang.org/grpc: v1.82.1 → v1.83.0

  📁 ./collectors/as400:
     - google.golang.org/grpc: v1.82.1 → v1.83.0

  📁 ./collectors/utmstack:
     - google.golang.org/grpc: v1.82.1 → v1.83.0

  📁 ./agent:
     - google.golang.org/grpc: v1.82.1 → v1.83.0

  📁 ./backend:
     - google.golang.org/grpc: v1.82.1 → v1.83.0
     - gorm.io/driver/postgres: v1.6.0 → v1.6.2

❌ Please update dependencies before merging.