Generic build for other GE sites: no WJ data, one shopfloor type, Windows USB builder

Everything West Jefferson specific moved out to a separate repo
(pxe-site-wj): NTLARS/UDC/heat-treat backups keyed by WJ machine numbers,
CMM and Wax/Trace bay lists, WJ OpenText profiles, site-config.json, the
WJ preinstall list, and the WJ shopfloor PC types (Collections,
NoCollections, Common, Keyence, CMM, Genspect, HeatTreat, Wax/Trace,
Display, PartMarker) with GE-Enforce, machine numbers and the desktop
layout. The part-marker bench tools moved to their own repo. Dead
scripts removed: build-proxmox-iso, deploy-bios, sync_hardware_models,
mirror-from-gold, pull-bios, startnet-template.cmd.

Shopfloor is one generic type, gea-shopfloor-standard, with today's
timing:
- PPKG at first logon (unattend Order 10, unchanged).
- Install-AppList.ps1 runs C:\PreInstall\preinstall.json during setup.
- A new SYSTEM task, GE Shopfloor Post-PPKG, runs postppkg.json once
  after the post-PPKG reboot. It also clears AutoLogonCount after the
  ShopFloor handover (the Users-level monitor can be denied that HKLM
  write) and removes the Intune Sync task when done.
- Both lists ship empty. A site adds entries and installers.
- WinPE choice 3 goes straight to the PPKG menu. Staging, fetch and heal
  carry only the generic payload. The webapp's shopfloor sub-menu editor
  is gone, and the imaging tiles name the new stages.
- The playbook deploys the empty lists only if missing. It now deploys
  the PowerShell 7 MSI the shopfloor unattend installs, which it never
  did before.

Blancco site settings move into the webapp (Updates > Blancco releases):
business location, licensing Wi-Fi SSID and password. They are rendered
into the served preferences.xml and applied to every staged release, and
are seeded from site-vars (site_name, blancco_wifi_ssid,
blancco_wifi_password) only while none exist. The repo XML carries no
site values; the plaintext Wi-Fi password is gone from it.

New site_name and site_timezone settings: report and evidence-pack site
name, server clock and webapp time zone. No more West Jefferson defaults
in webapp/config.py or the dashboard title. Sync-BPRT.ps1 gets the
server address filled in at download instead of WJ's GE address.

USB on Windows:
- scripts/Build-PxeUsb.ps1 runs the same checks as build-usb.sh. It
  writes one FAT32 CIDATA partition (ISO files plus patched grub.cfg plus
  payload) with diskpart and reads every file back by SHA-256.
- Tested with Windows PowerShell 5.1 in the win11 VM, and the layout
  installs and first-boots in the pxetest VM.
- scripts/stage-usb-share.sh stages the build folder on a share.
- site-content/ is optional for both builders.

KB docs/kb/How_To_Deploy_PXE_Server_New_Site.html: new-site deployment,
Windows only, with a site-vars.yml guide.

Checks: webapp tests pass (5 suites); the unattend lint and playbook
syntax checks pass; every .ps1 parses; there are no WJ hosts, IPs, names
or PC types in playbook/, webapp/, scripts/ or autoinstall/.

webapp/views/blancco_update.py

@@ -11,6 +11,7 @@ services/blancco_update.py; this module is the route surface.
 from flask import (Blueprint, abort, flash, jsonify, redirect, render_template, request,
                    send_file, url_for)
 
+from services import blancco_prefs
 from services import blancco_update as bu
 from services.audit import audit
 
@@ -37,9 +38,31 @@ def page():
         upload_dir=bu.upload_dir(),
         source_dirs=bu.source_dirs(),
         server=bu.SERVER,
+        site=blancco_prefs.public(),
     )
 
 
+@bp.route("/site-settings", methods=["POST"])
+def site_settings():
+    """Business location and licensing Wi-Fi: saved, then the served
+    preferences.xml is rendered again. The password is never shown back."""
+    try:
+        with bu._lock:
+            blancco_prefs.save(request.form.get("business_location", ""),
+                               request.form.get("wifi_ssid", ""),
+                               request.form.get("wifi_password", ""))
+            changed = blancco_prefs.render()
+    except (OSError, ValueError) as e:
+        flash(f"Blancco site settings not saved: {e}", "danger")
+        return _back()
+    s = blancco_prefs.public()
+    audit("BLANCCO_SITE_SETTINGS", f"location={s['business_location']!r} ssid={s['wifi_ssid']!r} "
+          f"password={'set' if s['wifi_password_set'] else 'empty'}")
+    flash("Blancco site settings saved" + (" and preferences.xml updated." if changed else " (no change)."),
+          "success")
+    return _back()
+
+
 @bp.route("/status.json")
 def status():
     job = bu.job_state()

webapp/views/bprt_sync.py

@@ -9,8 +9,10 @@ activation run as one background job at a time; logic lives in
 services/bprt_sync.py, this module is the route surface.
 """
 
+import re
+
 from flask import (Blueprint, abort, flash, jsonify, redirect, render_template,
-                   request, send_file, url_for)
+                   Response, request, send_file, url_for)
 
 from services import bprt_sync as bs
 from services import mcl_ppkg
@@ -131,7 +133,17 @@ def script():
     path = bs.sync_script()
     if not path:
         abort(404)
-    return send_file(path, mimetype="text/plain", as_attachment=True, download_name="Sync-BPRT.ps1")
+    # The server address as the work PC reached it (its GE address, port
+    # 9009) goes in as the default, so the script needs no edits.
+    host = request.host.split(":")[0]
+    if not re.fullmatch(r"[A-Za-z0-9.-]{1,253}", host):
+        abort(400)
+    with open(path, encoding="utf-8") as f:
+        text = f.read()
+    text = text.replace("[string]$WebUrl = '',", f"[string]$WebUrl = 'http://{host}:9009',", 1)
+    text = text.replace("[string]$SshHost = '',", f"[string]$SshHost = '{host}',", 1)
+    return Response(text, mimetype="text/plain",
+                    headers={"Content-Disposition": "attachment; filename=Sync-BPRT.ps1"})
 
 
 def _start(kind, arg, ok_msg, audit_action):