Endpoint telemetry, PC Detail rework and a checked backup/restore path

shopdb/core/api/settings.py

@@ -1320,6 +1320,21 @@ def build_default_settings():
                 'DeviceSettingsMenuBlade/~/overview/aadDeviceId/{deviceid}'
             )
         },
+        {
+            # ADR-015-OK: the DEFAULT is empty, so no cloud is assumed. Same
+            # reasoning as entra_device_url - the LAPS blade lives in the same
+            # tenant-specific portal, so the host cannot be a product fact.
+            'key': 'laps_device_url',
+            'value': '',
+            'valuetype': 'string',
+            'category': 'integrations',
+            'description': (
+                'Azure LAPS (local admin password) URL template. {objectid} is '
+                'the device object id. Example (US Gov): https://portal.azure.us/'
+                '?feature.msaljs=true#view/Microsoft_AAD_Devices/'
+                'DeviceDetailsMenuBlade/~/LocalAdminPassword/objectId/{objectid}'
+            )
+        },
         {
             'key': 'servicenow_ticket_prefixes',
             'value': 'GEINC,GECHG,GERIT,GESCT',
@@ -1488,6 +1503,99 @@ def build_default_settings():
                            'Incoming Webhook), adaptivecard (Teams Workflow), '
                            'or json (generic {title,text})'
         },
+        # Backup destination settings
+        #
+        # These are the ground wiring for where the one-shot backup container
+        # ships each set. 'local' keeps sets on the mounted backups volume and
+        # needs no credentials. 'smb' and 'aws' are declared so the UI and the
+        # backup runner can be configured now; the client libraries (an SMB
+        # stack, boto3/awscli) are deliberately NOT pulled in yet - those land
+        # behind the security review that vets third-party deps against
+        # external exploit. Until then a non-local destination is accepted and
+        # persisted but the runner treats it as not-yet-armed.
+        #
+        # Secrets follow the existing convention: any key containing
+        # 'password'/'secret'/'token' is masked by _is_secret on the way out
+        # and preserved when the client submits the mask back unchanged.
+        {
+            'key': 'backup_destination_kind',
+            'value': 'local',
+            'valuetype': 'string',
+            'category': 'backup',
+            'description': 'Where backup sets are shipped: local, smb, or aws. '
+                           'Non-local destinations are wiring-only until the '
+                           'security review clears their client libraries.'
+        },
+        {
+            'key': 'backup_smb_host',
+            'value': '',
+            'valuetype': 'string',
+            'category': 'backup',
+            'description': 'SMB/CIFS server hostname or IP for the backup share'
+        },
+        {
+            'key': 'backup_smb_share',
+            'value': '',
+            'valuetype': 'string',
+            'category': 'backup',
+            'description': 'SMB share name (the top-level export, no path)'
+        },
+        {
+            'key': 'backup_smb_path',
+            'value': '',
+            'valuetype': 'string',
+            'category': 'backup',
+            'description': 'Subpath within the SMB share to write sets into'
+        },
+        {
+            'key': 'backup_smb_username',
+            'value': '',
+            'valuetype': 'string',
+            'category': 'backup',
+            'description': 'SMB authentication username (DOMAIN\\user allowed)'
+        },
+        {
+            'key': 'backup_smb_password',
+            'value': '',
+            'valuetype': 'string',
+            'category': 'backup',
+            'description': 'SMB authentication password'
+        },
+        {
+            'key': 'backup_aws_region',
+            'value': '',
+            'valuetype': 'string',
+            'category': 'backup',
+            'description': 'AWS region for the S3 backup bucket (e.g. us-east-1)'
+        },
+        {
+            'key': 'backup_aws_bucket',
+            'value': '',
+            'valuetype': 'string',
+            'category': 'backup',
+            'description': 'S3 bucket name that holds backup sets'
+        },
+        {
+            'key': 'backup_aws_prefix',
+            'value': '',
+            'valuetype': 'string',
+            'category': 'backup',
+            'description': 'Optional key prefix within the S3 bucket'
+        },
+        {
+            'key': 'backup_aws_accesskeyid',
+            'value': '',
+            'valuetype': 'string',
+            'category': 'backup',
+            'description': 'AWS access key id for the backup bucket'
+        },
+        {
+            'key': 'backup_aws_secretaccesskey',
+            'value': '',
+            'valuetype': 'string',
+            'category': 'backup',
+            'description': 'AWS secret access key for the backup bucket'
+        },
         # Audit log retention lives at 'audit_retentiondays' (category site),
         # defined above and read by shopdb/core/services/auditretention.py. A
         # second key 'audit_retention_days' was seeded here with a different