geenforce: HTTPS payload delivery (content-addressed blob store + endpoint)

Lets share-less (Intune/local-account) PCs pull installers the manifest
references over HTTPS instead of SMB - the general capability the whole fleet
migrates toward. New ManifestBlob registry (migration 0002) with bytes on disk
at instance/geenforce/payloads/<sha256> (deduped by content); service.store_blob
+ blob_path; client-facing GET /api/geenforce/payload/<sha256> (geenforce.fetch
token, ETag=hash, serves the blob store or an inline DB payload by hash). The
serializer now emits PayloadSource/PayloadSha256/PayloadRef for http/inline
entries only (smb entries round-trip unchanged - parity green). CLI
'flask geenforce add-payload <file>' registers a blob and prints its sha256.
This is the shopdb half (B1); the PS client/engine fetch is B2.

plugins/geenforce/plugin.py

@@ -21,8 +21,8 @@ from .api import geenforce_bp
 from .models import (
     ManifestScope, ManifestEntry, ManifestEntryPcType, ManifestEntryHostname,
     ManifestEntryMachineNumber, ManifestInUseCheck, ManifestInUseCheckProcess,
-    ManifestPublishedVersion, ManifestPayload, ManifestEnforcementReport,
-    ManifestEnforcementResult, PcTypeAlias,
+    ManifestPublishedVersion, ManifestPayload, ManifestBlob,
+    ManifestEnforcementReport, ManifestEnforcementResult, PcTypeAlias,
 )
 from .filters import ALIAS_GROUPS
 
@@ -62,7 +62,7 @@ class GeEnforcePlugin(BasePlugin):
             ManifestScope, ManifestEntry, ManifestEntryPcType,
             ManifestEntryHostname, ManifestEntryMachineNumber,
             ManifestInUseCheck, ManifestInUseCheckProcess,
-            ManifestPublishedVersion, ManifestPayload,
+            ManifestPublishedVersion, ManifestPayload, ManifestBlob,
             ManifestEnforcementReport, ManifestEnforcementResult, PcTypeAlias,
         ]
 
@@ -191,4 +191,24 @@ class GeEnforcePlugin(BasePlugin):
                 path = export_scope_to_share(scopename, phase, shareroot)
                 click.echo(f"Exported to {path}.")
 
+        @geenforce_cli.command('add-payload')
+        @click.argument('filepath')
+        @click.option('--contenttype', default=None)
+        def add_payload_cmd(filepath, contenttype):
+            """Store a file in the content-addressed payload store for HTTPS
+            delivery, and print its sha256. Set an entry's PayloadSource=http +
+            PayloadSha256 to serve it from GET /api/geenforce/payload/<sha>."""
+            import os as _os
+            from flask import current_app
+            from .service import store_blob
+
+            with current_app.app_context():
+                with open(filepath, 'rb') as handle:
+                    raw = handle.read()
+                sha = store_blob(raw, _os.path.basename(filepath), contenttype)
+                db.session.commit()
+                click.echo(f"stored {len(raw)} bytes")
+                click.echo(f"PayloadSha256: {sha}")
+                click.echo(f"URL: /api/geenforce/payload/{sha}")
+
         return [geenforce_cli]