Clonezilla back up / restore by machine number

Boot menu: "Clonezilla: back up this PC" and "restore this PC" ask for the
machine number and boot Clonezilla (64-bit with Debian shim, or 32-bit
i686 by cpuid) with ocs_repository=smb3://clonezilla:<pw>@server/clonezilla/,
ocs_prerun fetching clonezilla-scripts/pxe-cz.sh and ocs_live_run running
it. The script validates the machine number, saves
<machine>-<YYYY-MM-DD-HHMM> (server time), writes pxe-meta.txt, runs
ocs-chkimg, and restores only that machine's images with -k1 -r after a
typed YES. The old entry is "Clonezilla: manual".

Playbook: clonezilla Samba user for the [clonezilla] share only, password
from clonezilla_smb_password (validated, filled into the menu
placeholder), scripts installed to the web root.

Webapp: Clonezilla backups page lists image folders and zips grouped by
machine number with serial/model/version/check, serial mismatch flag,
delete, move to another machine, streamed tar download, disk space bar
and an explicit keep-last-N retention with preview. Tests and a VM test
plan added.

docs/ARCHITECTURE.md

@@ -117,6 +117,14 @@ WinPE; the Blancco and Clonezilla utilities require Secure Boot disabled.
       The menu checks the CPU (iPXE cpuid --ext 29): 64-bit CPUs get the
       current release, 32-bit-only CPUs (XP-era Pentium 4/M, early Atom) get
       clonezilla-i686/ (3.2.0-5, the last 32-bit Clonezilla) over legacy BIOS.
+      "Clonezilla: back up / restore this PC" ask for the machine number,
+      mount \\<server>\clonezilla as the clonezilla Samba user
+      (ocs_repository smb3://, password from clonezilla_smb_password) and
+      run clonezilla-scripts/pxe-cz.sh (ocs_prerun downloads it,
+      ocs_live_run runs it): images are <machine>-<YYYY-MM-DD-HHMM> with
+      pxe-meta.txt, checked after saving; restore lists that machine's
+      images and restores with -k1 -r (larger disks get proportionally
+      larger partitions). "Clonezilla: manual" is the interactive mode.
 
    Memory testing is not on the menu: Dell PCs have a built-in test
    (F12 at power-on, Diagnostics). Memtest86+ was removed because it is