Share accounts: per-site Samba passwords from the webapp

Tools > Share accounts sets the pxe-upload, blancco and clonezilla Samba
passwords. Saving one runs smbpasswd and writes it everywhere it is used:
startnet.cmd in boot.wim (pxe-upload), the served Blancco preferences and
the live config.img (blancco), the iPXE menu's Clonezilla entries
(clonezilla). Refused while a PC is imaging unless forced. Stored 0600 in
UPDATES_DIR/shares/accounts.json, never shown back.

- The stored values are the authority: the playbook only creates the
  Samba accounts, seeds the store from site-vars (pxe_upload_password,
  blancco_smb_password, clonezilla_smb_password) for accounts it does not
  hold, and runs "share_accounts apply" at the end of every run.
- Every startnet save re-pins SHAREPASS, so a restored snapshot cannot
  bring an old password back; new menu blocks use %SHAREUSER%/%SHAREPASS%.
- Shop floor unattend Order 4 reads the login from fetch-source.txt;
  Invoke-PostPpkg deletes that file once the PPKG is applied.
- Upload-Image.ps1 asks for the password unless -Pass is given.
- pxe_admin_password: the Linux pxe login. Required while the box still
  has the shipped "pxe"; set with chpasswd when it differs.
- Blancco site settings now also reach the live config.img (BIOS path).

webapp/app.py

@@ -58,6 +58,7 @@ from services import (
     imaging_status,
     mcl_ppkg,
     nic_status,
+    share_accounts,
     system,
     unattend,
     upload_verify,
@@ -72,6 +73,7 @@ from views import images as images_views
 from views import images_drivers as images_drivers_views
 from views import images_unattend as images_unattend_views
 from views import engineering_layer as engineering_layer_views
+from views import share_accounts as share_accounts_views
 from views import ipxe as ipxe_views
 
 app = Flask(__name__)
@@ -99,6 +101,7 @@ app.register_blueprint(images_views.bp)
 app.register_blueprint(images_drivers_views.bp)
 app.register_blueprint(images_unattend_views.bp)  # Unattend review/save/undo
 app.register_blueprint(engineering_layer_views.bp)  # Engineer image: Engineering Layer upload
+app.register_blueprint(share_accounts_views.bp)  # Tools > Share accounts (Samba passwords)
 
 
 # ---------------------------------------------------------------------------
@@ -1605,6 +1608,13 @@ def _startnet_save_content(new_content, prior, action, detail):
         # still let the operator save (the raw editor is the source of truth).
         flash(f"Warning: could not snapshot prior startnet.cmd: {exc}", "warning")
 
+    # pxe-upload's password belongs to Tools > Share accounts: a restored
+    # snapshot or a hand edit cannot put an old one back.
+    pinned = share_accounts.pin_startnet(new_content)
+    if pinned != new_content:
+        flash("set SHAREPASS= was changed back to the pxe-upload password "
+              "(change it on Tools > Share accounts).", "warning")
+        new_content = pinned
     ok, err = wim.update_startnet(config.BOOT_WIM, new_content)
     if not ok:
         flash(f"Failed to update boot.wim: {err}", "danger")