Fix air-gapped deployment: pip wheel install, UFW ports, installer crash

- Fix pip/distutils incompatibility: install Python wheels directly via
  zipfile extraction instead of broken pip3 from Ubuntu 22.04 .debs
  (pip3 crashes on Python 3.12 with ModuleNotFoundError: distutils)
- Fix UFW port types: quote loop items so string comparison works
  correctly, giving ports 67/69 UDP rules instead of TCP
- Fix autoinstall crash: set refresh-installer to no (can't reach
  internet on air-gapped network, was crashing subiquity)
- Remove python3-pip and python3-venv from download-packages.sh
  (no longer needed with direct wheel extraction)
- Add ignore_errors to WinPE/iPXE copy tasks (files only present
  on real USB media, not test VM)
- Use system python3 instead of venv for webapp service

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

autoinstall/user-data

@@ -9,9 +9,7 @@ autoinstall:
     variant: ""
   timezone: America/New_York
 
-  # Network configuration
-  # Uses a broad match so any wired NIC gets the static PXE address.
-  # No WiFi needed — all packages are on the CIDATA partition.
+  # Network: static IP for isolated PXE LAN (no internet/DHCP needed)
   network:
     version: 2
     ethernets:
@@ -108,4 +106,4 @@ autoinstall:
     disable_root: false
 
   refresh-installer:
-    update: yes
+    update: no