Engineer image: upload the Engineering Layer from the web app

New Engineering Layer tab on the engineer image page. A site uploads
Engineering_Install_v<ver>.exe (keeps prereqs) or a .zip of the whole
extra_engineering payload. The upload is streamed to disk, checked (MZ
header, no unsafe zip paths) and swapped in; the replaced payload is
archived (two kept) with a Restore button. Install-EngineeringLayer.ps1
stays repo-owned and now installs the newest Engineering_Install_v*.exe.

KB: Part 4 becomes Site Content (enrollment package, Engineering Layer,
Blancco site settings, Shop Floor apps) plus a new Adding Shop Floor
Apps section for preinstall.json/postppkg.json. WJ examples removed.

webapp/services/image_pages.py

@@ -31,6 +31,9 @@ IMAGE_TABS = (
     {"id": "drivers", "label": "Drivers", "icon": "bi-hdd-network", "endpoint": "images_drivers.page"},
     {"id": "unattend", "label": "Unattend", "icon": "bi-file-earmark-code", "endpoint": "unattend_editor"},
     {"id": "os", "label": "OS and Packages", "icon": "bi-windows", "endpoint": "images.os_packages"},
+    # Only on the images listed in "images" (the header skips it elsewhere).
+    {"id": "englayer", "label": "Engineering Layer", "icon": "bi-box-seam",
+     "endpoint": "engineering_layer.page", "images": ("gea-engineer",)},
 )
 TAB_IDS = tuple(t["id"] for t in IMAGE_TABS)