Webapp: fix six live bugs found in the page inventory

- Report view: the hero summarised only the first erasure, so a drive whose
  Purge failed and Clear fallback succeeded showed Failed while the list said
  Successful. It now uses the per-drive outcome (report_result) and lists the
  standards that wiped each drive.
- To-do and ServiceNow: reports with no usable document id could never be
  ticked or cleared (400). They are now tracked by file name (file:<name>).
- Imaging: the LAPS password field is masked, with a Show/Hide toggle.
- Imaging: succeeded sessions not updated for ACTIVE_WINDOW_HOURS are hidden
  from the dashboard (failed and in-progress always stay), with Show all.
- Enrollment: the active SFLD package can no longer be deleted, which left
  ppkg.conf pointing at a missing file; its row is marked Active.
- Import: confirm before importing, saying upload-folder sources are moved
  and same-name files in the image are overwritten.

webapp/templates/imaging.html

@@ -22,6 +22,12 @@ function cancelImagingReload() {
   <div>
     <h1>Imaging Progress</h1>
     <small class="text-light">Live via SSE (15s polling fallback). Client pushes &rarr; <code class="mono">/imaging/status</code>; log-inferred bays in yellow.</small>
+    {% if hidden %}
+    <div class="small mt-1">{{ hidden }} finished session{{ 's' if hidden != 1 }} older than {{ window_hours }} h hidden.
+      <a href="{{ url_for('imaging_dashboard', all='1') }}">Show all</a></div>
+    {% elif show_all %}
+    <div class="small mt-1">Showing finished sessions of every age. <a href="{{ url_for('imaging_dashboard') }}">Hide old finished sessions</a></div>
+    {% endif %}
   </div>
   <div class="header-actions">
     <span class="status-indicator">
@@ -91,7 +97,7 @@ Content-Type: application/json
 // server signals a state change. Preserves scroll, filter input value,
 // and any LAPS input that the operator is actively editing.
 (function() {
-    var TILES_URL  = "{{ url_for('imaging_tiles_partial') }}";
+    var TILES_URL  = "{{ url_for('imaging_tiles_partial', all='1' if show_all else None) }}";
     var STREAM_URL = "{{ url_for('imaging_stream') }}";
     var POLL_MS    = 15000;
     var lastHash   = null;
@@ -308,6 +314,15 @@ document.addEventListener('click', function(e) {
     } else if (e.target.classList.contains('laps-clear-btn')) {
         card = e.target.closest('.laps-card');
         if (card) clearLapsQR(card);
+    } else if (e.target.classList.contains('laps-show-btn')) {
+        card = e.target.closest('.laps-card');
+        var inp = card && card.querySelector('.laps-input');
+        if (inp) {
+            var show = inp.type === 'password';
+            inp.type = show ? 'text' : 'password';
+            e.target.textContent = show ? 'Hide' : 'Show';
+            e.target.setAttribute('aria-pressed', show ? 'true' : 'false');
+        }
     }
 });
 document.addEventListener('keydown', function(e) {