blancco: CMMC evidence pack, ServiceNow tick list, cloud-upload status

Automates the Blancco parts of the onsite-support CMMC playbook:

- ENT-056/158 evidence pack: /reports/evidence?month=YYYY-MM returns
  ENT-056_<Site>_<YYYY-MM>.zip (summary.csv, README, each report's XML
  and PDF). pxe-blancco-evidence.timer saves last month's pack to the
  reports share's evidence/ folder on the 1st (Persistent).
- ENT-045/159 ServiceNow tick list: /reports/servicenow lists recent
  reports as "Wiped" or "Blancco Wipe failed" with a pre-written
  destruction note, copy buttons and Done (CSRF-protected).
- Cloud upload: blancco-progress.py posts each report's upload result
  ("Sending report document id" -> "Report sent to MC") to
  /reports/cloud-status (CSRF-exempt like /imaging/status); the Reports
  page and the CSVs show it, so a wipe missing from BMP is visible.
- CSV gains failure_reason (exception messages, failed steps, error
  counts), business_location and cloud_upload.
- Preferences: business_location "West Jefferson" (config.BLANCCO_SITE)
  and pdf+xml reports; the report copier now copies the PDF too, named
  after its XML. .part and hidden files are not listed as reports.

State (cloud confirmations, ServiceNow ticks) is a JSON file at
/var/lib/pxe-webapp/blancco-state.json, off the report share.

webapp/config.py

@@ -21,6 +21,11 @@ WEB_ROOT = os.environ.get("WEB_ROOT", "/var/www/html")
 BOOT_WIM = os.path.join(WEB_ROOT, "win11", "sources", "boot.wim")
 AUDIT_LOG = os.environ.get("AUDIT_LOG", "/var/log/pxe-webapp-audit.log")
 IMAGING_DIR = os.environ.get("IMAGING_DIR", "/var/log/pxe-imaging")
+# Blancco evidence: site name stamped on reports and evidence packs, and a
+# small JSON state file (cloud-upload confirmations, ServiceNow ticks) kept
+# off the report share so it never shows up as a report.
+BLANCCO_SITE = os.environ.get("BLANCCO_SITE", "West Jefferson")
+BLANCCO_STATE = os.environ.get("BLANCCO_STATE", "/var/lib/pxe-webapp/blancco-state.json")
 
 # Log sources used by services/imaging_log_tail.py to infer client progress
 # when no /imaging/status push has arrived yet. Override per-host if any of