Webapp: fix six live bugs found in the page inventory

- Report view: the hero summarised only the first erasure, so a drive whose
  Purge failed and Clear fallback succeeded showed Failed while the list said
  Successful. It now uses the per-drive outcome (report_result) and lists the
  standards that wiped each drive.
- To-do and ServiceNow: reports with no usable document id could never be
  ticked or cleared (400). They are now tracked by file name (file:<name>).
- Imaging: the LAPS password field is masked, with a Show/Hide toggle.
- Imaging: succeeded sessions not updated for ACTIVE_WINDOW_HOURS are hidden
  from the dashboard (failed and in-progress always stay), with Show all.
- Enrollment: the active SFLD package can no longer be deleted, which left
  ppkg.conf pointing at a missing file; its row is marked Active.
- Import: confirm before importing, saying upload-folder sources are moved
  and same-name files in the image are overwritten.

webapp/templates/import.html

@@ -168,7 +168,17 @@ document.addEventListener('DOMContentLoaded', function() {
   ['importForm', 'uploadImportForm'].forEach(function(formId) {
     var form = document.getElementById(formId);
     if (form) {
-      form.addEventListener('submit', function() {
+      form.addEventListener('submit', function(e) {
+        // Import overwrites same-name files in the image and, from the
+        // upload folder, moves (consumes) the source. Make that explicit.
+        var src = form.querySelector('select[name="source"]');
+        var tgt = form.querySelector('select[name="target"]');
+        var what = formId === 'uploadImportForm'
+          ? 'The files are MOVED out of the upload folder, so the source is used up.'
+          : 'The files are copied from the USB drive.';
+        var msg = 'Import ' + (src ? src.value : '') + ' into ' + (tgt ? tgt.options[tgt.selectedIndex].text : '') + '?\n\n'
+          + what + '\nFiles with the same name in the image are overwritten. This takes several minutes.';
+        if (!confirm(msg)) { e.preventDefault(); return; }
         var btn = form.querySelector('button[type="submit"]');
         btn.disabled = true;
         btn.innerHTML = '<span class="spinner-border spinner-border-sm me-1"></span> Importing...';