webapp: imaging progress dashboard + serial column on reports list

Adds end-to-end progress tracking for PXE imaging sessions and surfaces
each Blancco report's BIOS serial in the report list.

webapp:
  * services/imaging_status.py - JSON-per-serial state store under
    IMAGING_DIR (default /var/log/pxe-imaging). Atomic write via
    tempfile + rename. log_tail capped at 50 lines. Merges partial
    updates so clients can post just the current_stage tick.
  * config.py - new IMAGING_DIR env-overridable path.
  * services/csrf.py - explicit exempt list for machine-to-machine
    endpoints; /imaging/status is the first entry. Air-gapped LAN;
    trust-by-network for client posts.
  * app.py - four new routes:
      GET  /imaging               dashboard (renders all sessions)
      POST /imaging/status        client status push (JSON body)
      GET  /imaging/<serial>.json raw session JSON for ad-hoc polling
      POST /imaging/delete/<s>    clear a session from the dashboard
    Also parses each Blancco XML in the /reports list to surface
    system.serial + system.model columns.
  * templates/imaging.html - Bootstrap dashboard with per-session
    cards (state badge, progress bar, stage idx/total, mac, elapsed,
    log tail). meta http-equiv refresh=5 for auto-tick.
  * templates/base.html - new "Imaging Progress" nav entry.
  * templates/reports.html - Serial + Model columns added.

playbook:
  * shopfloor-setup/Shopfloor/lib/Send-PxeStatus.ps1 - new helper.
    Dot-source this then call Send-PxeStatus -Stage X -StageIndex N
    -StageTotal M from any stage script. BIOS serial via CIM, MAC via
    Get-NetAdapter, pctype + machinenumber from C:\Enrollment.
    Failures are swallowed to a local log so a network blip doesn't
    block imaging.
  * shopfloor-setup/Run-ShopfloorSetup.ps1 - dot-sources helper +
    posts at three coarse milestones (start, PPKG enrollment,
    handoff to Monitor-IntuneProgress).
  * shopfloor-setup/gea-shopfloor-keyence/09-Setup-Keyence.ps1 -
    posts at session start + after Install-FromManifest with
    succeeded/failed status derived from $rc. Other 09-Setup-*.ps1
    scripts can follow the same pattern.

ID is BIOS serial (stable across WinPE -> Windows transition and
across reboots, unlike hostname which is random pre-PPKG). Operator
already knows the serial of the bay they imaged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/Run-ShopfloorSetup.ps1

@@ -26,6 +26,21 @@ Write-Host "    Transcript: $transcriptPath"
 Write-Host "================================================================"
 Write-Host ""
 
+# Imaging-progress reporter. Posts coarse stage updates to the PXE webapp
+# at http://10.9.100.1:9009/imaging/status so the operator can watch
+# progress in a browser. Best-effort: failures never block imaging.
+$pxeStatusLib = Join-Path $PSScriptRoot 'Shopfloor\lib\Send-PxeStatus.ps1'
+if (Test-Path $pxeStatusLib) {
+    try { . $pxeStatusLib } catch { Write-Warning "Send-PxeStatus load failed: $_" }
+}
+function Report-Stage {
+    param([string]$Stage, [int]$Index, [int]$Total = 8, [string]$Status = 'in_progress', [string]$Error_ = '')
+    if (Get-Command Send-PxeStatus -ErrorAction SilentlyContinue) {
+        Send-PxeStatus -Stage $Stage -StageIndex $Index -StageTotal $Total -Status $Status -Error_ $Error_
+    }
+}
+Report-Stage -Stage 'Run-ShopfloorSetup: starting' -Index 1
+
 # AutoLogonCount is NOT set here. Previously we bumped it to 99/4, but
 # Windows decrements it per-logon and at 0 clears AutoAdminLogon -- which
 # nukes the lockdown-configured ShopFloor autologon later in the chain.
@@ -452,6 +467,7 @@ if (-not $hasWifi -and -not $hasDefaultRoute) {
 $enrollScript = Join-Path $enrollDir 'run-enrollment.ps1'
 if (Test-Path -LiteralPath $enrollScript) {
     Write-Host ""
+    Report-Stage -Stage 'Run-ShopfloorSetup: PPKG enrollment' -Index 4
     Write-Host "=== Running enrollment (PPKG install) ==="
     Write-Host "NOTE: PPKG schedules a near-immediate reboot. We will cancel"
     Write-Host "      it and hand off to Monitor-IntuneProgress -PostPpkg, which"
@@ -466,6 +482,7 @@ if (Test-Path -LiteralPath $enrollScript) {
     # persistent @logon sync_intune task fires on the next boot to resume
     # tracking through device-category-assignment + lockdown.
     Write-Host ""
+    Report-Stage -Stage 'Run-ShopfloorSetup: handoff to Monitor-IntuneProgress' -Index 7
     Write-Host "=== Handing off to Monitor-IntuneProgress -PostPpkg ==="
     cmd /c "shutdown /a 2>nul" | Out-Null
     $monitor = Join-Path $setupDir 'Shopfloor\lib\Monitor-IntuneProgress.ps1'