Webapp redesign: fixes from the code review

Blocker
- /reports/export returned 500: REPORT_EXPORT_RANGES and _months_ago were
  deleted with the old reports route. Restored.

Major
- A session without stage_index/stage_total took down /, /imaging and
  /imaging/tiles (int filter on Undefined). The templates default both;
  saving a LAPS password for a session that no longer exists is refused
  (it created a bare session).
- /reports/todo parsed every report four times (23 s at 700 reports).
  blancco_report.parse() now caches by path, mtime and size: 0.09 s.
- Stored XSS through the session serial in the Clear confirm (the
  browser decodes ' before running an inline handler). The message
  moves to data-confirm, and update_session() only accepts serials of
  letters, digits, '.', '_' and '-' (400 from /imaging/status otherwise).
- Reports without a document id and with odd characters in the file name
  got a key the mark routes rejected, so they could never be cleared.
  report_key() now always produces a valid key.

Minor
- failure_note() handles a list-valued erasure target (500 on the report
  and to-do pages).
- _recently_marked() tolerates naive, 'Z' and non-dict state entries.
- Key regexes use fullmatch (a trailing newline was accepted).
- Unreadable reports are no longer counted as to tick / to destroy; the
  reports page already flags them as Unreadable.
- Rollback review recounts restorable files after reading the backups.
- Enrollment: the startnet fallback package (no or empty ppkg.conf) and a
  quoted SOURCE_PPKG are protected too.
- Backup upload overwrite check is case-insensitive (SMB share) and
  replaces the existing file rather than adding a case twin.
- Overview polling keeps the last good rows on an error and pauses while
  the tab is hidden. A shown or typed LAPS password survives the floor's
  refresh.
- hardware_dismiss only redirects to same-site paths; tiles ?limit is
  clamped; the Updates overview survives an unreadable Dell scan or iPXE
  state; describe() uses aversion(); a client cannot label its session
  'inferred'.

webapp/services/dell_updates.py

@@ -1379,9 +1379,6 @@ def file_status(rec):
     return out
 
 
-_PACK_VER = re.compile(r"_(a\d+)", re.I)
-
-
 def _model_for_zip(zip_name, maps):
     """First model token of the map entry that uses zip_name, or ''."""
     for m in maps.values():
@@ -1399,9 +1396,9 @@ def describe(rec, maps=None):
     out = []
     for d in rec.get("drivers") or []:
         model = _model_for_zip(d.get("new", ""), maps) or _model_for_zip(d.get("old", ""), maps)
-        a, b = _PACK_VER.search(d.get("old", "") or ""), _PACK_VER.search(d.get("new", "") or "")
-        if model and a and b:
-            out.append(f"{model} pack {a.group(1).upper()} to {b.group(1).upper()}")
+        a, b = aversion(d.get("old", "")), aversion(d.get("new", ""))
+        if model and a is not None and b is not None:
+            out.append(f"{model} pack A{a:02d} to A{b:02d}")
         else:
             out.append(f"{d.get('old', '')} to {d.get('new', '')}")
     for b in rec.get("bios") or []:
@@ -1448,6 +1445,8 @@ def rollback_preview(apply_id, max_lines=400):
         if len(lines) > max_lines:
             lines = lines[:max_lines] + [f"... {len(lines) - max_lines} more lines"]
         f["diff"] = "\n".join(lines)
+    # A file whose backup could not be read above is no longer restorable.
+    rec["unchanged"] = sum(1 for f in rec["files"] if f["state"] == "unchanged")
     return rec