build-usb: whole webapp, hard sfdisk failure, ISO-derived boot params, image-file mode; tests/vm harness

- Copy the whole webapp/ tree (minus __pycache__) in build-usb.sh and
  build-proxmox-iso.sh, so config, services/, views/ and
  blancco_evidence_monthly.py reach the server.
- sfdisk --append failure now aborts; the CIDATA partition is the one
  starting exactly at the computed sector, and nothing that starts
  before it is ever formatted (the old fallback hit the ISO's EFI
  partition).
- Volume id and El Torito load sizes come from the ISO
  (xorriso -report_el_torito as_mkisofs); grub.cfg must contain
  autoinstall after patching.
- --image FILE SIZE|auto builds the same layout in a file without root
  (mkfs.vfat -C + mtools, sfdisk on the file). Plus --payload-root,
  --skip-enrollment/-bios/-drivers/-boot-tools, --yes.
- tests/vm: libvirt harness (pxetest-server, pxetest-client, isolated
  pxetest-imaging network) with fetch-iso/build-image/create/start/
  status/stop/destroy.

tests/vm/stop.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+# Shut pxetest VMs down (ACPI, then force after a timeout). Keeps them
+# defined. Idempotent.
+# Usage: tests/vm/stop.sh [server|client|all]   (default: all)
+source "$(dirname "$0")/common.sh"
+
+which="${1:-all}"
+case "$which" in
+    server) vms=("$SERVER_VM") ;;
+    client) vms=("$CLIENT_VM") ;;
+    all) vms=("$CLIENT_VM" "$SERVER_VM") ;;
+    *) die "usage: $0 [server|client|all]" ;;
+esac
+for vm in "${vms[@]}"; do
+    dom_exists "$vm" || continue
+    [ "$(dom_state "$vm")" = "shut off" ] && { log "$vm already off"; continue; }
+    virsh shutdown "$vm" >/dev/null 2>&1 || true
+    for _ in $(seq 1 60); do
+        [ "$(dom_state "$vm")" = "shut off" ] && break
+        sleep 1
+    done
+    if [ "$(dom_state "$vm")" != "shut off" ]; then
+        log "$vm ignored ACPI shutdown; forcing off"
+        virsh destroy "$vm" >/dev/null
+    fi
+    log "$vm off"
+done