Share accounts: per-site Samba passwords from the webapp

Tools > Share accounts sets the pxe-upload, blancco and clonezilla Samba
passwords. Saving one runs smbpasswd and writes it everywhere it is used:
startnet.cmd in boot.wim (pxe-upload), the served Blancco preferences and
the live config.img (blancco), the iPXE menu's Clonezilla entries
(clonezilla). Refused while a PC is imaging unless forced. Stored 0600 in
UPDATES_DIR/shares/accounts.json, never shown back.

- The stored values are the authority: the playbook only creates the
  Samba accounts, seeds the store from site-vars (pxe_upload_password,
  blancco_smb_password, clonezilla_smb_password) for accounts it does not
  hold, and runs "share_accounts apply" at the end of every run.
- Every startnet save re-pins SHAREPASS, so a restored snapshot cannot
  bring an old password back; new menu blocks use %SHAREUSER%/%SHAREPASS%.
- Shop floor unattend Order 4 reads the login from fetch-source.txt;
  Invoke-PostPpkg deletes that file once the PPKG is applied.
- Upload-Image.ps1 asks for the password unless -Pass is given.
- pxe_admin_password: the Linux pxe login. Required while the box still
  has the shipped "pxe"; set with chpasswd when it differs.
- Blancco site settings now also reach the live config.img (BIOS path).

webapp/services/blancco_update.py

@@ -988,6 +988,32 @@ def apply_prefs(version):
     return meta
 
 
+def refresh_live_prefs():
+    """Re-render the served preferences.xml (site settings, share login)
+    and write the same preferences into the live config.img, which the
+    BIOS (native) boot path reads instead. Returns True if a file changed.
+    release.json keeps describing the release when it did before."""
+    from services import blancco_prefs
+    with _lock:
+        root = blancco_root()
+        meta_path = os.path.join(root, "release.json")
+        meta = uc.read_json(meta_path, None)
+        meta_ok = bool(meta and meta.get("fingerprint") == _fingerprint(root))
+        changed = blancco_prefs.render()
+        cfg_path = os.path.join(root, "config.img")
+        cfg = _read(cfg_path)
+        if cfg is not None:
+            with open(blancco_prefs.served_prefs_path(), "rb") as f:
+                ours = f.read()
+            new = patch_config_img(cfg, ours)
+            if new != cfg:
+                _atomic_write(cfg_path, new)
+                changed = True
+        if changed and meta_ok:
+            _write_live_meta(meta)
+    return changed
+
+
 def save_merged_prefs(version, data):
     """A human-merged preferences.xml for a staged version: check it, keep it,
     and finish staging with it."""