notifications: let Recognition set start/end dates; geenforce B2 client payload fetch

Recognition edit hid the time fields (grouped with Recertification), so start/end
could not be adjusted even though the backend honors them. Show the time fields
for every type except Recertification (due-date driven); Recognition end still
auto-fills to the next 8 AM reset when blank.

Also GE-Enforce B2 client (HTTPS payload consume): ShopdbEnforceClient.psm1 gains
Get-ShopdbPayload (fetch by sha256, verify, cache) + Resolve-ShopdbPayloads
(rewrite http/inline entries to local staged files so the engine installs from
local, no SMB); Invoke-ShopdbEnforce resolves payloads before running the engine;
importer parses PayloadSource/PayloadSha256/PayloadRef. VM-verified: a SYSTEM
Windows client fetched a payload over HTTP by hash, hash matched.

plugins/geenforce/importer.py

@@ -48,6 +48,11 @@ def populate_entry(entry, entry_dict):
     # RegValue stored as its raw JSON literal so DWord vs string typing survives.
     entry.regvalue = (json.dumps(entry_dict['RegValue'])
                       if 'RegValue' in entry_dict else None)
+    # Payload transport (http/inline share-less delivery); default smb. Kept out
+    # of the scalar map so smb entries stay bare (conditional emit + parity).
+    entry.payloadsource = entry_dict.get('PayloadSource') or 'smb'
+    entry.payloadsha256 = entry_dict.get('PayloadSha256')
+    entry.payloadref = entry_dict.get('PayloadRef')
     for key, attr in _FLAG_TO_ATTR.items():
         setattr(entry, attr, bool(entry_dict.get(key)))
     # Multi-value filters -> child rows (replace, preserve order).