Generic build for other GE sites: no WJ data, one shopfloor type, Windows USB builder

Everything West Jefferson specific moved out to a separate repo
(pxe-site-wj): NTLARS/UDC/heat-treat backups keyed by WJ machine numbers,
CMM and Wax/Trace bay lists, WJ OpenText profiles, site-config.json, the
WJ preinstall list, and the WJ shopfloor PC types (Collections,
NoCollections, Common, Keyence, CMM, Genspect, HeatTreat, Wax/Trace,
Display, PartMarker) with GE-Enforce, machine numbers and the desktop
layout. The part-marker bench tools moved to their own repo. Dead
scripts removed: build-proxmox-iso, deploy-bios, sync_hardware_models,
mirror-from-gold, pull-bios, startnet-template.cmd.

Shopfloor is one generic type, gea-shopfloor-standard, with today's
timing:
- PPKG at first logon (unattend Order 10, unchanged).
- Install-AppList.ps1 runs C:\PreInstall\preinstall.json during setup.
- A new SYSTEM task, GE Shopfloor Post-PPKG, runs postppkg.json once
  after the post-PPKG reboot. It also clears AutoLogonCount after the
  ShopFloor handover (the Users-level monitor can be denied that HKLM
  write) and removes the Intune Sync task when done.
- Both lists ship empty. A site adds entries and installers.
- WinPE choice 3 goes straight to the PPKG menu. Staging, fetch and heal
  carry only the generic payload. The webapp's shopfloor sub-menu editor
  is gone, and the imaging tiles name the new stages.
- The playbook deploys the empty lists only if missing. It now deploys
  the PowerShell 7 MSI the shopfloor unattend installs, which it never
  did before.

Blancco site settings move into the webapp (Updates > Blancco releases):
business location, licensing Wi-Fi SSID and password. They are rendered
into the served preferences.xml and applied to every staged release, and
are seeded from site-vars (site_name, blancco_wifi_ssid,
blancco_wifi_password) only while none exist. The repo XML carries no
site values; the plaintext Wi-Fi password is gone from it.

New site_name and site_timezone settings: report and evidence-pack site
name, server clock and webapp time zone. No more West Jefferson defaults
in webapp/config.py or the dashboard title. Sync-BPRT.ps1 gets the
server address filled in at download instead of WJ's GE address.

USB on Windows:
- scripts/Build-PxeUsb.ps1 runs the same checks as build-usb.sh. It
  writes one FAT32 CIDATA partition (ISO files plus patched grub.cfg plus
  payload) with diskpart and reads every file back by SHA-256.
- Tested with Windows PowerShell 5.1 in the win11 VM, and the layout
  installs and first-boots in the pxetest VM.
- scripts/stage-usb-share.sh stages the build folder on a share.
- site-content/ is optional for both builders.

KB docs/kb/How_To_Deploy_PXE_Server_New_Site.html: new-site deployment,
Windows only, with a site-vars.yml guide.

Checks: webapp tests pass (5 suites); the unattend lint and playbook
syntax checks pass; every .ps1 parses; there are no WJ hosts, IPs, names
or PC types in playbook/, webapp/, scripts/ or autoinstall/.

SETUP.md

@@ -129,6 +129,31 @@ This creates a bootable USB with:
 - **Partition 1:** Ubuntu Server installer
 - **Partition 2:** CIDATA (autoinstall config, offline .debs, pip wheels, Ansible playbook, webapp, boot tools)
 
+#### Building the USB on a Windows PC
+
+`scripts/Build-PxeUsb.ps1` builds the same stick on Windows, with the same
+checks, no Linux tools needed. It writes ONE FAT32 partition labelled
+CIDATA holding the Ubuntu ISO's files (boot menu patched for autoinstall)
+and the payload; it boots in UEFI mode only (Secure Boot works) and is at
+most 32 GB (the FAT32 size Windows formats). Every file is read back and
+compared by SHA-256.
+
+On the build PC, put the repo and payload on the share:
+
+```bash
+./scripts/stage-usb-share.sh        # -> ~/pxe-images/pxe-usb (hard links)
+```
+
+On the Windows PC, in an elevated PowerShell (Z: = the pxe-images share):
+
+```powershell
+Z:\pxe-usb\scripts\Build-PxeUsb.ps1                                  # lists USB disks
+Z:\pxe-usb\scripts\Build-PxeUsb.ps1 -DiskNumber 3 -NoSiteVars        # or -SiteVars FILE
+```
+
+It refuses a disk that is not on the USB bus or is the boot/system disk,
+and asks you to type the disk number before erasing it.
+
 ### Step 4: Boot the Target Machine
 
 1. Insert the USB into the target machine
@@ -246,17 +271,15 @@ pxe-server/
 ├── bios-staging/                 # Dell BIOS update binaries (gitignored)
 ├── scripts/                      # Build, deploy, and helper scripts
 │   ├── build-usb.sh              # Builds the 2-partition installer USB
-│   ├── build-proxmox-iso.sh      # UNSUPPORTED (use build-usb.sh --image)
+│   ├── Build-PxeUsb.ps1          # Windows: builds the installer USB (one FAT32 partition)
+│   ├── stage-usb-share.sh        # Puts repo + payload on the pxe-images share for it
 │   ├── prepare-boot-tools.sh     # Extracts/patches boot tools from ISOs
 │   ├── download-packages.sh      # Downloads all offline packages
 │   ├── download-drivers.py       # Downloads Dell drivers from dell.com
-│   ├── deploy-bios.sh            # Pushes BIOS updates to enrollment share
 │   ├── capture-site-content.sh   # Pulls site content + fresh payload from a live server
-│   ├── sync_hardware_models.py   # Syncs hardware model configs across images
 │   ├── Upload-Image.ps1          # Windows: upload MCL cache to PXE via SMB
 │   └── Download-Drivers.ps1      # Windows: download hardware drivers from GE CDN
 ├── config/                       # Site-specific configuration overrides
-├── startnet-template.cmd         # startnet.cmd template (synced with playbook copy)
 ├── README.md                     # Project overview
 └── SETUP.md                      # Detailed setup guide (this file)
 ```