Share accounts: per-site Samba passwords from the webapp

Tools > Share accounts sets the pxe-upload, blancco and clonezilla Samba
passwords. Saving one runs smbpasswd and writes it everywhere it is used:
startnet.cmd in boot.wim (pxe-upload), the served Blancco preferences and
the live config.img (blancco), the iPXE menu's Clonezilla entries
(clonezilla). Refused while a PC is imaging unless forced. Stored 0600 in
UPDATES_DIR/shares/accounts.json, never shown back.

- The stored values are the authority: the playbook only creates the
  Samba accounts, seeds the store from site-vars (pxe_upload_password,
  blancco_smb_password, clonezilla_smb_password) for accounts it does not
  hold, and runs "share_accounts apply" at the end of every run.
- Every startnet save re-pins SHAREPASS, so a restored snapshot cannot
  bring an old password back; new menu blocks use %SHAREUSER%/%SHAREPASS%.
- Shop floor unattend Order 4 reads the login from fetch-source.txt;
  Invoke-PostPpkg deletes that file once the PPKG is applied.
- Upload-Image.ps1 asks for the password unless -Pass is given.
- pxe_admin_password: the Linux pxe login. Required while the box still
  has the shipped "pxe"; set with chpasswd when it differs.
- Blancco site settings now also reach the live config.img (BIOS path).

playbook/shopfloor-setup/Shopfloor/Invoke-PostPpkg.ps1

@@ -13,6 +13,8 @@
 #      same, but it runs as Users and the HKLM write can be denied.
 #   3. Once Monitor-IntuneProgress has written C:\Enrollment\sync-complete.txt,
 #      remove the "Shopfloor Intune Sync" logon task.
+# Also, once the PPKG is applied, delete C:\Enrollment\fetch-source.txt (the
+# pxe-upload share login startnet leaves for the first-logon scripts).
 # When all three are done the task unregisters itself.
 #
 # Never throws: every step logs and the script exits 0.
@@ -47,6 +49,19 @@ if (Test-Path -LiteralPath $doneMarker) {
     }
 }
 
+# 1b. fetch-source.txt holds the pxe-upload share password (startnet writes
+#     it for the first-logon Fetch/Verify scripts). Once the PPKG has run the
+#     PC is off the imaging LAN and the file has no use left.
+$fetchSource = 'C:\Enrollment\fetch-source.txt'
+if ((Test-Path -LiteralPath $appliedMarker) -and (Test-Path -LiteralPath $fetchSource)) {
+    try {
+        Remove-Item -LiteralPath $fetchSource -Force -ErrorAction Stop
+        Write-Host "Removed $fetchSource (share login)."
+    } catch {
+        Write-Warning "Could not remove ${fetchSource}: $_"
+    }
+}
+
 # 2. AutoLogonCount after the ShopFloor handover
 $handedOver = $false
 $countGone  = $true