Re-imaging the same PC: clear its stale SMB/conntrack state every time

A PC whose imaging failed and is re-imaged gets the same IP, and the
server still held state from the dead run, so net use failed (System
error 53). The April fix (18537ac) did not cover it:

- The dnsmasq hook only acted on 'add'/'del'. A re-image comes back to the
  existing lease, which dnsmasq reports as 'old', and only when the
  hostname/MAC changed. Now dnsmasq sets script-on-renewal, and the hook
  clears state on 'old' when the request comes from PXE firmware or iPXE
  (vendor class PXEClient), i.e. the machine just network-booted. A
  Windows lease renewal (MSFT 5.0) is left alone.
- The 1 h conntrack timeout never applied after a reboot: systemd-sysctl
  runs before ufw loads nf_conntrack, so the keys did not exist and the
  5-day default stayed. /etc/modules-load.d/pxe-conntrack.conf loads it
  first.
- smb-soft-reset.sh flushed neighbours on br-pxe, which no longer exists.

Live 2026-10-14. Hook tested on the server with an unused IP: network-boot
renewal clears, Windows renewal and no vendor class do not, add clears.

playbook/pxe_server_setup.yml

@@ -205,6 +205,11 @@
           # client re-images the same machine and hits a stale SMB session.
           # Script runs as root by default (dnsmasq --dhcp-scriptuser default).
           dhcp-script=/usr/local/sbin/pxe-dhcp-hook.sh
+          # Also call it when a client comes back to its existing lease (a
+          # re-image of the same PC), which dnsmasq otherwise reports only if
+          # the hostname or MAC changed. The hook acts on those only for PXE
+          # firmware / iPXE requests.
+          script-on-renewal
 
     - name: "Create TFTP directory"
       file:
@@ -628,6 +633,15 @@
         mode: '0644'
       notify: reload sysctl
 
+    - name: "Load nf_conntrack at boot so the conntrack sysctl applies"
+      # systemd-sysctl runs before ufw loads nf_conntrack, so without this the
+      # net.netfilter.* keys do not exist yet at boot and the 1 h timeout is
+      # silently skipped (the kernel default of 5 days stays in force).
+      copy:
+        dest: /etc/modules-load.d/pxe-conntrack.conf
+        content: "nf_conntrack\n"
+        mode: '0644'
+
     - name: "Deploy SMB diagnostic + soft-reset helper scripts"
       copy:
         src: "{{ usb_mount }}/pxe-server-helpers/{{ item }}"