Add an All PCs policy scope that excludes servers

The policy builder only offered "Matches everything" (the `true` scope node),
which also targets servers. Authoring an estate-wide policy almost always means
"every PC an operator sits at", and a reboot or script push against a server is
a materially different event.

Adds an `allpcs` scope node that matches every endpoint except those whose
computer type is server-designated. Server designation reads the computer type's
ICON slug, which is nominally a UI hint and is now load-bearing; it was chosen
over matching the type NAME (a site can rename "Server") and over a new isserver
column (needs a migration). It is isolated behind SERVER_ICON so promoting it to
a real flag later is a one-place change.

The `true` node is retained and still matches servers, so existing policies keep
their exact meaning rather than silently re-scoping. It stays visible in the
dropdown only when editing a policy that already uses it; new policies default
to `allpcs`.

Covered by tests/test_plugins/test_computers_policy_allpcs.py, verified against
a planted canary so the server-exclusion assertions are known to bite.

plugins/computers/services/policyresolver.py

@@ -20,7 +20,7 @@ The result is an EffectivePolicy: a flat, resolved map of action name -> decisio
 and the allowlist need.
 """
 
-from .policyscope import evaluate_scope
+from .policyscope import SERVER_ICON, evaluate_scope
 
 
 class EffectiveAction:
@@ -100,15 +100,21 @@ class EffectivePolicy:
 def build_endpoint_context(computer):
     """Resolve a Computer row into the context the scope evaluator needs.
 
-    Returns {'computertypeid': int|None, 'appids': set[int]}.
+    Returns {'computertypeid': int|None, 'appids': set[int], 'isserver': bool}.
     """
     appids = set()
     for link in getattr(computer, 'installedapps', None) or ():
         if getattr(link, 'isactive', True) and link.appid is not None:
             appids.add(link.appid)
+    # Server designation rides on the computer type's icon slug; policyscope
+    # owns that rule, we just resolve it for the endpoint. An unset type is not
+    # a server.
+    computertype = getattr(computer, 'computertype', None)
+    isserver = getattr(computertype, 'icon', None) == SERVER_ICON
     return {
         'computertypeid': getattr(computer, 'computertypeid', None),
         'appids': appids,
+        'isserver': isserver,
     }
 
 

plugins/computers/services/policyscope.py

@@ -11,7 +11,21 @@ Node grammar (all dict nodes carry a "type"):
     {"type": "not",    "node": <node>}
     {"type": "pctype", "id": <computertypeid:int>}
     {"type": "app",    "id": <appid:int>}
-    {"type": "true"}   # matches everything (an unscoped/global policy)
+    {"type": "allpcs"} # every PC EXCEPT those whose type is designated a server
+    {"type": "true"}   # matches everything, servers included
+
+"allpcs" vs "true": authoring an estate-wide policy almost always means "every
+PC an operator sits at", not "every computer we have a row for". Those differ by
+the servers, where a reboot or a script push is a materially different event.
+"true" is retained because a stored scope of None is equivalent to it and older
+policies were written with it, but the builder offers "All PCs" instead.
+
+Server designation is read from the computer type's ICON slug ('server'). That
+field is nominally a UI hint, which is a real wart - it is load-bearing here. It
+was chosen over matching the type NAME because a site can rename "Server" but a
+renamed type keeps its icon, and over a new isserver column because that needs a
+migration this did not warrant. If server designation ever becomes a first-class
+flag, this is the single place that reads it.
 
 Kept pure and dependency-free (no db, no Flask) so it is trivially unit-tested
 and so a future GE-Enforce assembly engine can reuse the exact same evaluator on
@@ -22,8 +36,12 @@ the exact same AST when it composes policies.
 # recursion. Ten levels is far past any policy a human would author.
 MAX_SCOPE_DEPTH = 10
 
+# The computer-type icon slug that designates a type as a server. See the module
+# docstring for why the icon carries this.
+SERVER_ICON = 'server'
+
 _LOGICAL = {'and', 'or', 'not'}
-_LEAF = {'pctype', 'app', 'true'}
+_LEAF = {'pctype', 'app', 'true', 'allpcs'}
 
 
 class ScopeError(ValueError):
@@ -60,7 +78,7 @@ def validate_scope(node, _depth=0):
         ident = node.get('id')
         if not isinstance(ident, int) or isinstance(ident, bool):
             raise ScopeError(f'{ntype} requires an integer "id"')
-    # 'true' carries no payload.
+    # 'true' and 'allpcs' carry no payload.
 
 
 def evaluate_scope(node, context):
@@ -69,6 +87,7 @@ def evaluate_scope(node, context):
     context is expected to expose:
         context['computertypeid'] -> int or None
         context['appids']         -> set/collection of installed appids
+        context['isserver']       -> bool, whether the type is server-designated
 
     Returns True when the endpoint falls in scope. An empty/None scope means the
     policy is unscoped and matches everything (same as {"type": "true"}), which
@@ -80,6 +99,10 @@ def evaluate_scope(node, context):
     ntype = node['type']
     if ntype == 'true':
         return True
+    if ntype == 'allpcs':
+        # Absent designation means "not a server": an endpoint with no type set
+        # is an ordinary PC until something says otherwise.
+        return not context.get('isserver', False)
     if ntype == 'and':
         return all(evaluate_scope(child, context) for child in node['nodes'])
     if ntype == 'or':