Webapp: Updates pages, image page tabs with review-before-save, BPRT sync

Updates group:
- Dell drivers and BIOS: check Dell's catalogs against all three driver maps
  and models.txt, download with a shared speed cap, repack, preview, apply
  with backups and rollback.
- iPXE boot files: check GitHub for the signed Secure Boot set, verify the
  sha256 and each file's signer, install atomically, roll back. Includes the
  by-hand procedure.
- Blancco: upload a release, stage it, test-boot it from the menu, activate,
  roll back.
- BPRT sync: validate a batch uploaded from the MediaCreator Lite cache
  (scripts/windows/Sync-BPRT.ps1 or a zip), show the diff, swap with the site
  overlay files kept.

Images: one sidebar entry per image with Overview, Drivers, Unattend and OS and
Packages tabs. Every save shows a diff first, keeps the file's format, makes a
backup and can be undone. Driver lint runs inline.

Enrollment: upload standard/engineer MCL packages, one per tenant/purpose,
with archive and restore. Hardware coverage counts engineer as Win11.

webapp/templates/hardware.html

@@ -15,6 +15,13 @@
   {% else %}<span class="badge badge-danger">No BIOS entry</span>{% endif %}
 {%- endmacro %}
 
+{# A newer Dell pack/BIOS for the file this model uses, from the last Updates > Dell scan. #}
+{% macro update_hint(found, file) -%}
+  {% if file and file | lower in found %}
+  <div class="mt-1"><a href="{{ url_for('dell_updates.page') }}" class="badge badge-info text-decoration-none" title="{{ file }}: Dell has {{ found[file | lower] or 'a newer version' }}. Open Updates to download it.">Update {{ found[file | lower] }}</a></div>
+  {% endif %}
+{%- endmacro %}
+
 {% block content %}
 <div class="page-header">
   <h1><i class="bi bi-cpu"></i> Hardware Coverage</h1>
@@ -53,8 +60,8 @@
           </td>
           <td class="mono">{{ r.skus | join(', ') or '-' }}</td>
           <td class="mono">{{ r.last_bios_version or '-' }}</td>
-          {% for image, os_label in images %}<td>{{ driver_badge(r.drivers[image]) }}</td>{% endfor %}
-          <td>{{ bios_badge(r.bios) }}</td>
+          {% for image, os_label in images %}<td>{{ driver_badge(r.drivers[image]) }}{{ update_hint(hints.drivers, r.drivers[image].file) }}</td>{% endfor %}
+          <td>{{ bios_badge(r.bios) }}{{ update_hint(hints.bios, r.bios.file) }}</td>
           <td class="mono text-nowrap">{{ r.last_seen | local_dt }}<div class="small text-muted">{{ r.count }} boot{{ 's' if r.count != 1 }}</div></td>
           <td class="text-end text-nowrap">
             {% if r.gap %}