webapp: extract service layer (config.py + services/) from app.py

Phase 1a of a multi-session refactor toward a clean blueprint
structure. Pulls the helper code that lived alongside the routes in
the 1621-line app.py into focused modules. app.py is now 625 lines
of mostly routes plus a small Flask wiring header. Behaviour is
unchanged: smoke-tested against the 8 main GET routes (200 OK).

New modules:

- config.py            env vars + IMAGE_TYPES + FRIENDLY_NAMES +
                       SHARED_DEPLOY_* taxonomy + unattend XML
                       namespaces.
- services/audit.py    audit log file handler + audit() helper.
- services/csrf.py     session CSRF token + before_request validator
                       wired via init_csrf(app).
- services/fs.py       image_root / deploy_path / unattend_path /
                       control_path / tools_path + load_json /
                       save_json + resolve_destination.
- services/system.py   service_status / find_usb_mounts /
                       find_upload_sources.
- services/images.py   image_status + load_image_config.
- services/deploy.py   import_deploy + _merge_tree +
                       _replace_with_symlink + allowed_import_source.
- services/unattend.py parse_unattend / build_unattend_xml /
                       extract_form_data and the qn / qwcm / settings
                       pass helpers.
- services/wim.py      extract_startnet / update_startnet / list_files
                       wrapping wimextract / wimupdate / wimdir.

Endpoint names kept stable (dashboard, clonezilla_backups, etc.) so
existing url_for(...) calls in templates are unchanged. Phase 1b
(Flask blueprints with ".endpoint" naming) deferred to a future
session because it requires updating ~30 url_for sites in templates
and is mostly cosmetic.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

webapp/services/audit.py

@@ -0,0 +1,26 @@
+"""Audit logging for the PXE webapp.
+
+Every write-action route should call ``audit(action, detail)`` to record
+who did what. The log lives at ``AUDIT_LOG`` (configurable via env var)
+and is consumed by the /audit page.
+"""
+
+import logging
+
+from flask import request
+
+import config
+
+_audit_handler = logging.FileHandler(config.AUDIT_LOG, mode="a")
+_audit_handler.setFormatter(logging.Formatter("%(asctime)s  %(message)s"))
+
+audit_logger = logging.getLogger("pxe_audit")
+audit_logger.setLevel(logging.INFO)
+if not audit_logger.handlers:
+    audit_logger.addHandler(_audit_handler)
+
+
+def audit(action, detail=""):
+    """Write an entry to the audit log."""
+    ip = request.remote_addr if request else "system"
+    audit_logger.info(f"[{ip}] {action}: {detail}")