build-usb: whole webapp, hard sfdisk failure, ISO-derived boot params, image-file mode; tests/vm harness

- Copy the whole webapp/ tree (minus __pycache__) in build-usb.sh and
  build-proxmox-iso.sh, so config, services/, views/ and
  blancco_evidence_monthly.py reach the server.
- sfdisk --append failure now aborts; the CIDATA partition is the one
  starting exactly at the computed sector, and nothing that starts
  before it is ever formatted (the old fallback hit the ISO's EFI
  partition).
- Volume id and El Torito load sizes come from the ISO
  (xorriso -report_el_torito as_mkisofs); grub.cfg must contain
  autoinstall after patching.
- --image FILE SIZE|auto builds the same layout in a file without root
  (mkfs.vfat -C + mtools, sfdisk on the file). Plus --payload-root,
  --skip-enrollment/-bios/-drivers/-boot-tools, --yes.
- tests/vm: libvirt harness (pxetest-server, pxetest-client, isolated
  pxetest-imaging network) with fetch-iso/build-image/create/start/
  status/stop/destroy.

tests/vm/README.md

@@ -0,0 +1,60 @@
+# pxetest VM harness
+
+Proves a new PXE server can be built from this repo, in two libvirt VMs on
+a laptop, without root and without touching a real network.
+
+## Topology
+
+| Object            | What                                                                 |
+|-------------------|----------------------------------------------------------------------|
+| `pxetest-imaging` | libvirt network, bridge `virbr-pxetest`. No `<forward>`, no `<ip>`: the host has no address on it and libvirt runs no DHCP there. Only VM taps are on the bridge. |
+| `default`         | libvirt NAT, 192.168.122.0/24. Stands in for the GE/corp network.    |
+| `pxetest-server`  | 2 vCPU, 4 GiB, q35 + OVMF Secure Boot (MS keys), 60G thin qcow2 (`vda`, boot 1), the USB image as a USB disk (`sda`, boot 2). |
+| `pxetest-client`  | 2 vCPU, 2 GiB, OVMF Secure Boot (MS keys), 1G blank disk, network boot first (UEFI IPv4 PXE, virtio-net, OVMF driver, no option ROM). |
+
+NIC MACs (fixed):
+
+| VM     | NIC     | MAC                 | Network           | Playbook var      |
+|--------|---------|---------------------|-------------------|-------------------|
+| server | GE      | `52:54:00:9e:10:01` | `default` NAT     | `pxe_ge_mac` / corp_nic_mac |
+| server | imaging | `52:54:00:9e:10:02` | `pxetest-imaging` | `pxe_imaging_mac` / pxe_nic_mac |
+| client | -       | `52:54:00:9e:10:03` | `pxetest-imaging` | -                 |
+
+The disk boots before the USB on purpose: a blank disk falls through to
+the installer, and after the install the server boots its disk instead of
+re-running autoinstall. CIDATA stays attached for the first-boot playbook.
+
+Never attach a pxetest VM to a physical NIC, a host bridge with physical
+ports, or macvtap: the server's dnsmasq serves DHCP/PXE as 172.16.9.1.
+`create.sh`, `start.sh` and `status.sh` check the isolation and refuse to
+continue if `pxetest-imaging` ever gains a `<forward>`, an `<ip>`, a host
+IPv4 address or a non-tap bridge port.
+
+## Run it
+
+    export PXETEST_CACHE=~/.cache/pxetest               # ISO + image (about 10 GB)
+    export PXETEST_PAYLOAD_ROOT=/home/camp/projects/pxe  # checkout holding offline-packages/, boot-files/, ...
+
+    tests/vm/fetch-iso.sh        # Ubuntu 24.04.5 live-server ISO, SHA256SUMS-verified
+    tests/vm/build-image.sh      # build-usb.sh --image, upload as volume pxetest-usb.img
+    tests/vm/create.sh           # network, volumes, both VMs (prints the MAC pins)
+    tests/vm/start.sh server     # autoinstall, reboot, first-boot playbook
+    tests/vm/status.sh --shot /tmp/pxetest-shots   # states, leases, screenshots
+    tests/vm/start.sh client     # once the server playbook is done
+    tests/vm/stop.sh             # ACPI shutdown both, keep them defined
+    tests/vm/destroy.sh          # remove every pxetest-* object
+
+`build-image.sh` skips enrollment/, bios-staging/, drivers-staging/ and
+boot-tools/ by default; `--with-enrollment` and `--with-boot-tools` add
+them back, `--size 20G` fixes the image size (default `auto`). If the host
+has no `sfdisk` or `mtools`, the debs are extracted into
+`$PXETEST_CACHE/tools` (no install, no root).
+
+Watch the server with `virt-viewer -c qemu:///system pxetest-server` (VNC on
+127.0.0.1) or screenshots. On the installed system, first-boot output goes
+to `/var/log/first-boot.log`. Once the GE NIC takes a DHCP lease on the NAT
+network, `status.sh` shows its address and `ssh pxe@<address>` works from
+the host.
+
+Memory: server 4 GiB + client 2 GiB. Keep other VMs (win11) off while
+both run, and stop them when done.