Add an All PCs policy scope that excludes servers

The policy builder only offered "Matches everything" (the `true` scope node),
which also targets servers. Authoring an estate-wide policy almost always means
"every PC an operator sits at", and a reboot or script push against a server is
a materially different event.

Adds an `allpcs` scope node that matches every endpoint except those whose
computer type is server-designated. Server designation reads the computer type's
ICON slug, which is nominally a UI hint and is now load-bearing; it was chosen
over matching the type NAME (a site can rename "Server") and over a new isserver
column (needs a migration). It is isolated behind SERVER_ICON so promoting it to
a real flag later is a one-place change.

The `true` node is retained and still matches servers, so existing policies keep
their exact meaning rather than silently re-scoping. It stays visible in the
dropdown only when editing a policy that already uses it; new policies default
to `allpcs`.

Covered by tests/test_plugins/test_computers_policy_allpcs.py, verified against
a planted canary so the server-exclusion assertions are known to bite.

plugins/computers/services/policyresolver.py

@@ -20,7 +20,7 @@ The result is an EffectivePolicy: a flat, resolved map of action name -> decisio
 and the allowlist need.
 """
 
-from .policyscope import evaluate_scope
+from .policyscope import SERVER_ICON, evaluate_scope
 
 
 class EffectiveAction:
@@ -100,15 +100,21 @@ class EffectivePolicy:
 def build_endpoint_context(computer):
     """Resolve a Computer row into the context the scope evaluator needs.
 
-    Returns {'computertypeid': int|None, 'appids': set[int]}.
+    Returns {'computertypeid': int|None, 'appids': set[int], 'isserver': bool}.
     """
     appids = set()
     for link in getattr(computer, 'installedapps', None) or ():
         if getattr(link, 'isactive', True) and link.appid is not None:
             appids.add(link.appid)
+    # Server designation rides on the computer type's icon slug; policyscope
+    # owns that rule, we just resolve it for the endpoint. An unset type is not
+    # a server.
+    computertype = getattr(computer, 'computertype', None)
+    isserver = getattr(computertype, 'icon', None) == SERVER_ICON
     return {
         'computertypeid': getattr(computer, 'computertypeid', None),
         'appids': appids,
+        'isserver': isserver,
     }