webapp: fix review findings (imaging types, NIC status, iPXE gates)

- imaging: coerce client payload and stored session fields to str/int,
  drop lists/dicts; tiles template guards pctype/current_stage; POST
  rejects non-object bodies and non-string serials.
- nic_status: normalise every check-file entry; load nic.conf as-is with
  a [nic] fallback; split interface= lists; keep the check's binding while
  fresh, resolve wildcard sockets from the dnsmasq pin (never True for an
  excluded NIC); mark vanished NICs down; include role bridges; stale or
  future-dated files downgrade to warnings and drop evidence.
- Overview renders the network pill in its own try and shows
  'Network: unknown' when status fails.
- ipxe_update: read every Authenticode signature (all WIN_CERTIFICATE
  entries plus nested SPC_NESTED_SIGNATURE) with openssl; shim swap and
  install need both Microsoft UEFI CA 2011 and 2023; install re-reads
  each file (snponly ipxe.efi only); staged.json schema version, older
  records shown stale and refused; uhci counts as native USB.
- backups describe their files; risky rollbacks need a confirm flag.
- mac_folders: guarded listdir, cached describe, configured TFTP root,
  warning for a shim without ipxe.efi.
- evidence pack: years 2000..2100, 400 days inclusive.
- a11y role=group on quick ranges; progress bar stays full during 'shim'.
- tests/test_review_fixes.py: 29 unittest cases incl. both real shims.

webapp/views/ipxe.py

@@ -9,6 +9,7 @@ services/ipxe_update.py; this module is the route surface.
 
 from flask import Blueprint, flash, jsonify, redirect, render_template, request, url_for
 
+import config
 from services import ipxe_update, updates_common
 from services.audit import audit
 from views import save_speed_cap
@@ -33,6 +34,7 @@ def page():
         installed_sha={n: (i or {}).get("sha256") for n, i in by_name.items()},
         routing=ipxe_update.dnsmasq_routing(),
         mac_folders=ipxe_update.mac_folders(),
+        tftp_root=config.TFTP_ROOT.rstrip("/") or "/",
         latest=latest,
         status=status,
         job=ipxe_update.job_state(),
@@ -99,7 +101,7 @@ def rollback():
     # rollback() looks the id up by its last path part only; log that.
     backup_id = request.form.get("backup", "").replace("\\", "/").rsplit("/", 1)[-1]
     try:
-        files = ipxe_update.rollback(backup_id)
+        files = ipxe_update.rollback(backup_id, confirm=request.form.get("confirm") == "1")
     except Exception as ex:
         flash(f"Rollback failed: {ex}", "danger")
         return _back()