Add Proxmox ISO builder, CSRF protection, boot-files integration

- Add build-proxmox-iso.sh: remaster Ubuntu ISO with autoinstall config,
  offline packages, playbook, webapp, and boot files for zero-touch
  Proxmox VM deployment
- Add boot-files/ directory for WinPE boot files (wimboot, boot.wim,
  BCD, ipxe.efi, etc.) sourced from WestJeff playbook
- Update build-usb.sh and test-vm.sh to bundle boot-files automatically
- Add usb_root variable to playbook, fix all file copy paths to use it
- Unify Apache VirtualHost config (merge default site + webapp proxy)
- Add CSRF token protection to all webapp POST forms and API endpoints
- Update README with Proxmox deployment instructions

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

build-usb.sh

@@ -194,6 +194,22 @@ else
     echo "    No pip-wheels/ found (run download-packages.sh first)"
 fi
 
+# Copy WinPE boot files (wimboot, boot.wim, BCD, ipxe.efi, etc.)
+BOOT_FILES_DIR="$SCRIPT_DIR/boot-files"
+if [ -d "$BOOT_FILES_DIR" ]; then
+    BOOT_FILE_COUNT=0
+    for bf in "$BOOT_FILES_DIR"/*; do
+        if [ -f "$bf" ]; then
+            cp "$bf" "$MOUNT_POINT/"
+            BOOT_FILE_COUNT=$((BOOT_FILE_COUNT + 1))
+        fi
+    done
+    BOOT_FILES_SIZE=$(du -sh "$BOOT_FILES_DIR" | cut -f1)
+    echo "    Copied $BOOT_FILE_COUNT boot files ($BOOT_FILES_SIZE) — wimboot, boot.wim, ipxe.efi, etc."
+else
+    echo "    WARNING: No boot-files/ found (copy WinPE boot files from Media Creator)"
+fi
+
 # Copy boot tools (Clonezilla, Blancco, Memtest) if prepared
 BOOT_TOOLS_DIR="$SCRIPT_DIR/boot-tools"
 if [ -d "$BOOT_TOOLS_DIR" ]; then