build-usb: whole webapp, hard sfdisk failure, ISO-derived boot params, image-file mode; tests/vm harness

- Copy the whole webapp/ tree (minus __pycache__) in build-usb.sh and
  build-proxmox-iso.sh, so config, services/, views/ and
  blancco_evidence_monthly.py reach the server.
- sfdisk --append failure now aborts; the CIDATA partition is the one
  starting exactly at the computed sector, and nothing that starts
  before it is ever formatted (the old fallback hit the ISO's EFI
  partition).
- Volume id and El Torito load sizes come from the ISO
  (xorriso -report_el_torito as_mkisofs); grub.cfg must contain
  autoinstall after patching.
- --image FILE SIZE|auto builds the same layout in a file without root
  (mkfs.vfat -C + mtools, sfdisk on the file). Plus --payload-root,
  --skip-enrollment/-bios/-drivers/-boot-tools, --yes.
- tests/vm: libvirt harness (pxetest-server, pxetest-client, isolated
  pxetest-imaging network) with fetch-iso/build-image/create/start/
  status/stop/destroy.

tests/vm/start.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+# Start pxetest VMs. Idempotent (a running VM is left alone).
+# Usage: tests/vm/start.sh [server|client|all]   (default: server)
+# Start the client only once the server's playbook has finished; both
+# together use 6 GiB.
+source "$(dirname "$0")/common.sh"
+
+which="${1:-server}"
+case "$which" in
+    server) vms=("$SERVER_VM") ;;
+    client) vms=("$CLIENT_VM") ;;
+    all) vms=("$SERVER_VM" "$CLIENT_VM") ;;
+    *) die "usage: $0 [server|client|all]" ;;
+esac
+
+net_exists "$IMAGING_NET" || die "run create.sh first"
+net_active "$IMAGING_NET" || virsh net-start "$IMAGING_NET" >/dev/null
+assert_imaging_isolated
+
+for vm in "${vms[@]}"; do
+    dom_exists "$vm" || die "$vm not defined; run create.sh"
+    if [ "$vm" = "$SERVER_VM" ]; then
+        vol_exists "$USB_VOL" || die "no $USB_VOL; run build-image.sh"
+    fi
+    if [ "$(dom_state "$vm")" = "running" ]; then
+        log "$vm already running"
+    else
+        virsh start "$vm" >/dev/null
+        log "started $vm (VNC: $(virsh vncdisplay "$vm" 2>/dev/null | head -1))"
+    fi
+done
+assert_imaging_isolated