build-usb: whole webapp, hard sfdisk failure, ISO-derived boot params, image-file mode; tests/vm harness

- Copy the whole webapp/ tree (minus __pycache__) in build-usb.sh and
  build-proxmox-iso.sh, so config, services/, views/ and
  blancco_evidence_monthly.py reach the server.
- sfdisk --append failure now aborts; the CIDATA partition is the one
  starting exactly at the computed sector, and nothing that starts
  before it is ever formatted (the old fallback hit the ISO's EFI
  partition).
- Volume id and El Torito load sizes come from the ISO
  (xorriso -report_el_torito as_mkisofs); grub.cfg must contain
  autoinstall after patching.
- --image FILE SIZE|auto builds the same layout in a file without root
  (mkfs.vfat -C + mtools, sfdisk on the file). Plus --payload-root,
  --skip-enrollment/-bios/-drivers/-boot-tools, --yes.
- tests/vm: libvirt harness (pxetest-server, pxetest-client, isolated
  pxetest-imaging network) with fetch-iso/build-image/create/start/
  status/stop/destroy.

tests/vm/fetch-iso.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+# Download the Ubuntu live-server ISO into the cache and verify it against
+# the release's SHA256SUMS. Idempotent: a verified ISO is not re-fetched.
+#
+# Usage: tests/vm/fetch-iso.sh
+# Env:   PXETEST_CACHE, UBUNTU_ISO_NAME (default ubuntu-24.04.5-live-server-amd64.iso)
+source "$(dirname "$0")/common.sh"
+
+mkdir -p "$PXETEST_CACHE"
+cd "$PXETEST_CACHE"
+
+log "fetching $UBUNTU_RELEASE_URL/SHA256SUMS"
+curl -fsSL -m 60 -o SHA256SUMS.new "$UBUNTU_RELEASE_URL/SHA256SUMS" \
+    || die "could not download SHA256SUMS (proxy? offline?)"
+mv SHA256SUMS.new SHA256SUMS
+
+if ! grep -q "[ *]$UBUNTU_ISO_NAME\$" SHA256SUMS; then
+    log "available live-server ISOs:"
+    grep live-server SHA256SUMS | sed 's/^/    /'
+    die "$UBUNTU_ISO_NAME is not in SHA256SUMS; set UBUNTU_ISO_NAME"
+fi
+
+verify() { grep "[ *]$UBUNTU_ISO_NAME\$" SHA256SUMS | sha256sum -c --status; }
+
+if [ -f "$UBUNTU_ISO_NAME" ] && verify; then
+    log "ISO already present and verified: $UBUNTU_ISO"
+    exit 0
+fi
+
+log "downloading $UBUNTU_RELEASE_URL/$UBUNTU_ISO_NAME (resumable)"
+curl -fL -C - --retry 3 -o "$UBUNTU_ISO_NAME" "$UBUNTU_RELEASE_URL/$UBUNTU_ISO_NAME" \
+    || die "ISO download failed (proxy? offline?)"
+if ! verify; then
+    rm -f "$UBUNTU_ISO_NAME"
+    die "SHA256 mismatch for $UBUNTU_ISO_NAME (deleted; run again)"
+fi
+log "ISO verified: $UBUNTU_ISO"