Fix review findings: offline assets, security, audit logging

- Bundle Bootstrap CSS/JS/icons locally for air-gapped operation
- Add path traversal validation on image import source
- Disable Flask debug mode in production
- Fix file handle leaks, remove unused import
- Add python3-pip, python3-venv, p7zip-full to offline packages
- Add pip wheel download/bundling for offline Flask install
- Change UFW default policy from allow to deny
- Fix wrong path displayed in unattend editor template
- Dynamic sidebar image lists from all_image_types
- Add audit logging for all write operations
- Audit log viewer page with activity history

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

webapp/templates/unattend_editor.html

@@ -43,7 +43,7 @@
     <h2 class="mb-1">{{ friendly_name }}</h2>
     <small class="text-muted">
       <i class="bi bi-file-earmark-code me-1"></i>
-      <code>{{ image_type }}/Deploy/Control/unattend.xml</code>
+      <code>{{ image_type }}/Deploy/FlatUnattendW10.xml</code>
     </small>
   </div>
   <div>