Clonezilla back up / restore by machine number

Boot menu: "Clonezilla: back up this PC" and "restore this PC" ask for the
machine number and boot Clonezilla (64-bit with Debian shim, or 32-bit
i686 by cpuid) with ocs_repository=smb3://clonezilla:<pw>@server/clonezilla/,
ocs_prerun fetching clonezilla-scripts/pxe-cz.sh and ocs_live_run running
it. The script validates the machine number, saves
<machine>-<YYYY-MM-DD-HHMM> (server time), writes pxe-meta.txt, runs
ocs-chkimg, and restores only that machine's images with -k1 -r after a
typed YES. The old entry is "Clonezilla: manual".

Playbook: clonezilla Samba user for the [clonezilla] share only, password
from clonezilla_smb_password (validated, filled into the menu
placeholder), scripts installed to the web root.

Webapp: Clonezilla backups page lists image folders and zips grouped by
machine number with serial/model/version/check, serial mismatch flag,
delete, move to another machine, streamed tar download, disk space bar
and an explicit keep-last-N retention with preview. Tests and a VM test
plan added.

playbook/site-vars.example.yml

@@ -35,3 +35,10 @@ corp_nic_mac: ""    # e.g. "20:88:10:af:0d:e5"
 # Optional: kernel the Blancco UEFI entries boot (must be installed; see
 # scripts/download-packages.sh BLANCCO_KVER).
 # blancco_kver: "7.0.0-34-generic"
+
+# Recommended: the password of the Samba account "clonezilla", which can
+# open only the [clonezilla] share (Clonezilla back up / restore by machine
+# number). The iPXE menu carries it, so treat it as an imaging-LAN secret,
+# not a real one. 8-64 characters from A-Z a-z 0-9 . _ ~ - (default
+# "clonezilla-backup").
+# clonezilla_smb_password: "change-me-per-site"