Generic build for other GE sites: no WJ data, one shopfloor type, Windows USB builder

Everything West Jefferson specific moved out to a separate repo
(pxe-site-wj): NTLARS/UDC/heat-treat backups keyed by WJ machine numbers,
CMM and Wax/Trace bay lists, WJ OpenText profiles, site-config.json, the
WJ preinstall list, and the WJ shopfloor PC types (Collections,
NoCollections, Common, Keyence, CMM, Genspect, HeatTreat, Wax/Trace,
Display, PartMarker) with GE-Enforce, machine numbers and the desktop
layout. The part-marker bench tools moved to their own repo. Dead
scripts removed: build-proxmox-iso, deploy-bios, sync_hardware_models,
mirror-from-gold, pull-bios, startnet-template.cmd.

Shopfloor is one generic type, gea-shopfloor-standard, with today's
timing:
- PPKG at first logon (unattend Order 10, unchanged).
- Install-AppList.ps1 runs C:\PreInstall\preinstall.json during setup.
- A new SYSTEM task, GE Shopfloor Post-PPKG, runs postppkg.json once
  after the post-PPKG reboot. It also clears AutoLogonCount after the
  ShopFloor handover (the Users-level monitor can be denied that HKLM
  write) and removes the Intune Sync task when done.
- Both lists ship empty. A site adds entries and installers.
- WinPE choice 3 goes straight to the PPKG menu. Staging, fetch and heal
  carry only the generic payload. The webapp's shopfloor sub-menu editor
  is gone, and the imaging tiles name the new stages.
- The playbook deploys the empty lists only if missing. It now deploys
  the PowerShell 7 MSI the shopfloor unattend installs, which it never
  did before.

Blancco site settings move into the webapp (Updates > Blancco releases):
business location, licensing Wi-Fi SSID and password. They are rendered
into the served preferences.xml and applied to every staged release, and
are seeded from site-vars (site_name, blancco_wifi_ssid,
blancco_wifi_password) only while none exist. The repo XML carries no
site values; the plaintext Wi-Fi password is gone from it.

New site_name and site_timezone settings: report and evidence-pack site
name, server clock and webapp time zone. No more West Jefferson defaults
in webapp/config.py or the dashboard title. Sync-BPRT.ps1 gets the
server address filled in at download instead of WJ's GE address.

USB on Windows:
- scripts/Build-PxeUsb.ps1 runs the same checks as build-usb.sh. It
  writes one FAT32 CIDATA partition (ISO files plus patched grub.cfg plus
  payload) with diskpart and reads every file back by SHA-256.
- Tested with Windows PowerShell 5.1 in the win11 VM, and the layout
  installs and first-boots in the pxetest VM.
- scripts/stage-usb-share.sh stages the build folder on a share.
- site-content/ is optional for both builders.

KB docs/kb/How_To_Deploy_PXE_Server_New_Site.html: new-site deployment,
Windows only, with a site-vars.yml guide.

Checks: webapp tests pass (5 suites); the unattend lint and playbook
syntax checks pass; every .ps1 parses; there are no WJ hosts, IPs, names
or PC types in playbook/, webapp/, scripts/ or autoinstall/.

webapp/templates/updates_blancco.html

@@ -66,6 +66,11 @@
     .sec-h, .upl, .prog { padding-left: 16px; padding-right: 16px; }
     .cur { padding: 18px 16px; }
   }
+  .site-form { margin-top: 12px; }
+  .site-grid { display: grid; grid-template-columns: max-content minmax(0, 28rem); gap: 8px 14px; align-items: center; }
+  .site-grid .form-label { margin: 0; }
+  .site-act { margin-top: 12px; }
+  @media (max-width: 640px) { .site-grid { grid-template-columns: minmax(0, 1fr); } }
 </style>
 {% endblock %}
 
@@ -144,6 +149,33 @@
   <div class="sub" style="overflow-wrap: anywhere">Served from <span class="mono">{{ current.path }}</span>.</div>
 </section>
 
+{# ---- Site settings ------------------------------------------------------- #}
+<section class="panel cur" aria-labelledby="site-h">
+  <div class="cur-top">
+    <div>
+      <h2 id="site-h" class="sec" style="font-size: 15px; color: var(--muted)">Site settings</h2>
+      <div class="sub">On every erasure report, and the Wi-Fi Blancco joins to license erasures in the GE Blancco cloud. Saved into every release, including ones staged later.</div>
+    </div>
+    <span style="margin-left: auto">{% if not site.configured %}{{ ui.chip('Not set', 'warn') }}{% elif not site.business_location or not site.wifi_password_set %}{{ ui.chip('Incomplete', 'warn') }}{% else %}{{ ui.chip('Set', 'ok') }}{% endif %}</span>
+  </div>
+  <form method="post" action="{{ url_for('blancco_update.site_settings') }}" class="site-form" autocomplete="off">
+    <input type="hidden" name="_csrf_token" value="{{ csrf_token() }}">
+    <div class="site-grid">
+      <label class="form-label" for="bpLoc">Business location</label>
+      <input type="text" class="form-control" id="bpLoc" name="business_location" maxlength="128"
+             value="{{ site.business_location }}" placeholder="Site name, e.g. Lynn">
+      <label class="form-label" for="bpSsid">Wi-Fi network (SSID)</label>
+      <input type="text" class="form-control" id="bpSsid" name="wifi_ssid" maxlength="128" required
+             value="{{ site.wifi_ssid }}">
+      <label class="form-label" for="bpPass">Wi-Fi password</label>
+      <input type="password" class="form-control" id="bpPass" name="wifi_password" maxlength="128"
+             autocomplete="new-password"
+             placeholder="{{ 'Set (leave empty to keep it)' if site.wifi_password_set else 'Not set' }}">
+    </div>
+    <div class="site-act"><button type="submit" class="ui-btn pri sm">Save</button></div>
+  </form>
+</section>
+
 {# ---- Staged -------------------------------------------------------------- #}
 <section class="panel ui-list" aria-labelledby="stg-h">
   <div class="sec-h"><div><h2 id="stg-h" class="sec">Staged releases</h2>