Webapp: fix six live bugs found in the page inventory

- Report view: the hero summarised only the first erasure, so a drive whose
  Purge failed and Clear fallback succeeded showed Failed while the list said
  Successful. It now uses the per-drive outcome (report_result) and lists the
  standards that wiped each drive.
- To-do and ServiceNow: reports with no usable document id could never be
  ticked or cleared (400). They are now tracked by file name (file:<name>).
- Imaging: the LAPS password field is masked, with a Show/Hide toggle.
- Imaging: succeeded sessions not updated for ACTIVE_WINDOW_HOURS are hidden
  from the dashboard (failed and in-progress always stay), with Show all.
- Enrollment: the active SFLD package can no longer be deleted, which left
  ppkg.conf pointing at a missing file; its row is marked Active.
- Import: confirm before importing, saying upload-folder sources are moved
  and same-name files in the image are overwritten.

webapp/services/imaging_status.py

@@ -15,7 +15,7 @@ import json
 import os
 import re
 import tempfile
-from datetime import datetime, timezone
+from datetime import datetime, timedelta, timezone
 from typing import Optional
 
 import config
@@ -220,6 +220,29 @@ def list_sessions(include_inferred: bool = True) -> list[dict]:
     return out
 
 
+def hide_stale(sessions: list[dict], hours: float = ACTIVE_WINDOW_HOURS) -> tuple[list[dict], int]:
+    """Drop succeeded sessions not updated for `hours` from the dashboard list.
+
+    Failed and in-progress sessions always stay: a failure must be seen and
+    cleared by someone. Returns (kept, hidden_count).
+    """
+    cutoff = datetime.now().astimezone() - timedelta(hours=hours)
+    kept, hidden = [], 0
+    for s in sessions:
+        if s.get("status") == "succeeded":
+            try:
+                when = datetime.fromisoformat(s.get("last_updated") or "")
+                if when.tzinfo is None:
+                    when = when.astimezone()
+            except ValueError:
+                when = None
+            if when is not None and when < cutoff:
+                hidden += 1
+                continue
+        kept.append(s)
+    return kept, hidden
+
+
 def get_session(serial: str) -> Optional[dict]:
     path = _path_for(serial)
     if not os.path.isfile(path):