webapp: fix review findings (imaging types, NIC status, iPXE gates)

- imaging: coerce client payload and stored session fields to str/int,
  drop lists/dicts; tiles template guards pctype/current_stage; POST
  rejects non-object bodies and non-string serials.
- nic_status: normalise every check-file entry; load nic.conf as-is with
  a [nic] fallback; split interface= lists; keep the check's binding while
  fresh, resolve wildcard sockets from the dnsmasq pin (never True for an
  excluded NIC); mark vanished NICs down; include role bridges; stale or
  future-dated files downgrade to warnings and drop evidence.
- Overview renders the network pill in its own try and shows
  'Network: unknown' when status fails.
- ipxe_update: read every Authenticode signature (all WIN_CERTIFICATE
  entries plus nested SPC_NESTED_SIGNATURE) with openssl; shim swap and
  install need both Microsoft UEFI CA 2011 and 2023; install re-reads
  each file (snponly ipxe.efi only); staged.json schema version, older
  records shown stale and refused; uhci counts as native USB.
- backups describe their files; risky rollbacks need a confirm flag.
- mac_folders: guarded listdir, cached describe, configured TFTP root,
  warning for a shim without ipxe.efi.
- evidence pack: years 2000..2100, 400 days inclusive.
- a11y role=group on quick ranges; progress bar stays full during 'shim'.
- tests/test_review_fixes.py: 29 unittest cases incl. both real shims.

webapp/templates/_imaging_tiles.html

@@ -60,18 +60,22 @@
 {% set track_kind = {'failed': 'fail', 'action': 'act', 'running': 'run', 'done': 'ok'} %}
 
 {% macro floor_row(s) %}
+  {# Sessions are sanitised on load; these guards keep a row rendering if a
+     non-string still slips through (a lookup or `in` on a list raises). #}
+  {% set pctype = s.pctype if s.pctype is string else '' %}
+  {% set cur_stage = s.current_stage if s.current_stage is string else '' %}
   {% set is_inferred = (s.source == 'inferred') %}
-  {% set is_blancco = (s.source == 'blancco' or s.pctype == 'blancco') %}
+  {% set is_blancco = (s.source == 'blancco' or pctype == 'blancco') %}
   {% set stage_idx = (s.stage_index or 0) | int(0) %}
   {% set stage_total = (s.stage_total or 0) | int(0) %}
-  {% set state = s.floor_state or 'running' %}
+  {% set state = s.floor_state if s.floor_state in state_chip else 'running' %}
   {% set drive_pct = None %}
-  {% if is_blancco and stage_idx == 4 and s.current_stage and '%]' in s.current_stage %}
-    {% set drive_pct = s.current_stage.split('[')[-1].split('%')[0] | int(0) %}
+  {% if is_blancco and stage_idx == 4 and cur_stage and '%]' in cur_stage %}
+    {% set drive_pct = cur_stage.split('[')[-1].split('%')[0] | int(0) %}
   {% endif %}
   {% set warn = False %}
   {% if is_inferred %}
-    {% set friendly = inferred_stage_labels.get(s.current_stage, ('Inferred from logs', s.current_stage or '')) %}
+    {% set friendly = inferred_stage_labels.get(cur_stage, ('Inferred from logs', cur_stage)) %}
   {% elif is_blancco %}
     {% if s.status == 'failed' %}
       {% set friendly = ('Erasure FAILED', 'Blancco reported a failed erasure step. Check the log tail and the report.') %}
@@ -80,18 +84,18 @@
     {% endif %}
     {% if stage_idx == 4 and s.status != 'failed' %}{% set warn = True %}{% endif %}
   {% else %}
-    {% set friendly = (desk_stage_labels if s.pctype in desk_kind else stage_labels).get(stage_idx, ('Stage ' ~ stage_idx, '')) %}
-    {% if stage_idx == 1 and s.current_stage and 'bios update staged' in s.current_stage|lower %}
+    {% set friendly = (desk_stage_labels if pctype in desk_kind else stage_labels).get(stage_idx, ('Stage ' ~ stage_idx, '')) %}
+    {% if stage_idx == 1 and cur_stage and 'bios update staged' in cur_stage|lower %}
       {% set friendly = ('Applying image - BIOS update staged',
           'WinPE staged a firmware update for this model. It flashes during the reboot after the image is applied: do NOT power off then.') %}
       {% set warn = True %}
-    {% elif stage_idx == 1 and s.current_stage and 'bios' in s.current_stage|lower %}
+    {% elif stage_idx == 1 and cur_stage and 'bios' in cur_stage|lower %}
       {% set friendly = ('Updating BIOS: do not power off',
           'WinPE detected a firmware update for this model. Do NOT power off until the next reboot. Imaging continues afterward.') %}
       {% set warn = True %}
     {% endif %}
-    {% if stage_idx == 7 and s.current_stage %}
-      {% set _cs = s.current_stage|lower %}
+    {% if stage_idx == 7 and cur_stage %}
+      {% set _cs = cur_stage|lower %}
       {% if 'ready for lockdown' in _cs or 'request lockdown' in _cs %}
         {% set friendly = ('Ready - request lockdown',
           'Phase 1-4 all complete (Registration, Device Config, Software Deploy, Credentials). Click "ARTS request" to initiate the lockdown workflow.') %}
@@ -112,11 +116,11 @@
   {% if s.hostname_target and s.serial %}{% set _ = ident.append(s.hostname_target) %}{% endif %}
   {% if s.ip %}{% set _ = ident.append(s.ip) %}{% endif %}
   {% set title = s.serial or s.hostname_target or s.mac or s.ip or '(unknown bay)' %}
-  {% set kind = 'Blancco wipe' if is_blancco else desk_kind.get(s.pctype, s.pctype or '') %}
+  {% set kind = 'Blancco wipe' if is_blancco else desk_kind.get(pctype, pctype) %}
   <div class="ui-row floor-row imaging-card" data-state="{{ state }}"
        data-serial="{{ s.serial or '' }}" data-key="{{ card_key }}" data-mac="{{ s.mac or '' }}"
        data-ip="{{ s.ip or '' }}" data-source="{{ s.source or 'client' }}"
-       data-filter="{{ (s.serial or '')|lower }} {{ (s.hostname_target or '')|lower }} {{ (s.pctype or '')|lower }} {{ (s.machinenumber or '')|lower }} {{ (s.intune_device_id or '')|lower }} {{ friendly[0]|lower }} stage-{{ stage_idx }} {{ (s.status or 'in_progress')|lower }} {{ (s.mac or '')|lower }} {{ (s.ip or '') }} {{ s.source or 'client' }}">
+       data-filter="{{ (s.serial or '')|lower }} {{ (s.hostname_target or '')|lower }} {{ pctype|lower }} {{ (s.machinenumber or '')|lower }} {{ (s.intune_device_id or '')|lower }} {{ friendly[0]|lower }} stage-{{ stage_idx }} {{ (s.status or 'in_progress')|lower }} {{ (s.mac or '')|lower }} {{ (s.ip or '') }} {{ s.source or 'client' }}">
     <details class="imaging-toggle">
       <summary class="frow">
         <span class="g-st">{{ ui.chip(state_chip[state][0], state_chip[state][1]) }}</span>