build-usb: whole webapp, hard sfdisk failure, ISO-derived boot params, image-file mode; tests/vm harness

- Copy the whole webapp/ tree (minus __pycache__) in build-usb.sh and
  build-proxmox-iso.sh, so config, services/, views/ and
  blancco_evidence_monthly.py reach the server.
- sfdisk --append failure now aborts; the CIDATA partition is the one
  starting exactly at the computed sector, and nothing that starts
  before it is ever formatted (the old fallback hit the ISO's EFI
  partition).
- Volume id and El Torito load sizes come from the ISO
  (xorriso -report_el_torito as_mkisofs); grub.cfg must contain
  autoinstall after patching.
- --image FILE SIZE|auto builds the same layout in a file without root
  (mkfs.vfat -C + mtools, sfdisk on the file). Plus --payload-root,
  --skip-enrollment/-bios/-drivers/-boot-tools, --yes.
- tests/vm: libvirt harness (pxetest-server, pxetest-client, isolated
  pxetest-imaging network) with fetch-iso/build-image/create/start/
  status/stop/destroy.

scripts/build-proxmox-iso.sh

@@ -225,9 +225,12 @@ echo "    Copied playbook/"
 
 # Flask webapp
 if [ -d "$WEBAPP_DIR" ]; then
-    mkdir -p "$PXE_DATA/webapp"
-    cp "$WEBAPP_DIR/app.py" "$WEBAPP_DIR/requirements.txt" "$PXE_DATA/webapp/"
-    cp -r "$WEBAPP_DIR/templates" "$WEBAPP_DIR/static" "$PXE_DATA/webapp/"
+    # Whole tree: app.py imports config, services/ and views/, and the
+    # Blancco evidence timer runs blancco_evidence_monthly.py.
+    rm -rf "$PXE_DATA/webapp"
+    cp -r "$WEBAPP_DIR" "$PXE_DATA/webapp"
+    find "$PXE_DATA/webapp" -name __pycache__ -type d -prune -exec rm -rf {} +
+    find "$PXE_DATA/webapp" -name '*.py[co]' -delete
     echo "    Copied webapp/"
 fi