Separate WinRM Windows credentials from Sonic SMC logins.

WinRM no longer reuses Administrator/Administrator; empty WinRm* uses the current Windows user, with clearer auth errors and LocalCmd guidance.

Co-authored-by: Cursor <cursoragent@cursor.com>

ZA.CoreService.ESBCertificateManager/Models/SonicConnection.cs

@@ -21,9 +21,27 @@ public sealed class SonicConnection
     /// </summary>
     public required string ConnectionUrl { get; init; }
 
+    /// <summary>Sonic SMC / Domain Manager Login (nicht für WinRM).</summary>
     public required string Username { get; init; }
+
+    /// <summary>Sonic SMC / Domain Manager Passwort (nicht für WinRM).</summary>
     public required string Password { get; init; }
 
+    /// <summary>
+    /// Windows-Konto für WinRM (<c>Invoke-Command -Credential</c>).
+    /// Leer = aktueller Prozess-Benutzer ohne explizite Credentials.
+    /// Nicht mit <see cref="Username"/>/<see cref="Password"/> (Sonic SMC) verwechseln.
+    /// </summary>
+    public string WinRmUsername { get; init; } = string.Empty;
+
+    /// <summary>Windows-Passwort für WinRM; nur relevant wenn <see cref="WinRmUsername"/> gesetzt ist.</summary>
+    public string WinRmPassword { get; init; } = string.Empty;
+
+    /// <summary>
+    /// WinRm = remote via PowerShell Remoting;
+    /// LocalCmd = lokal auf dem Sonic-Server (kein WinRM, App muss dort laufen);
+    /// HttpApi = REST.
+    /// </summary>
     public SonicManagementMode ManagementMode { get; init; } = SonicManagementMode.WinRm;
 
     /// <summary>Sonic-Installationsroot, z.B. "C:\Sonic\MQ10.0".</summary>