geenforce: HTTPS payload delivery (content-addressed blob store + endpoint)

Lets share-less (Intune/local-account) PCs pull installers the manifest
references over HTTPS instead of SMB - the general capability the whole fleet
migrates toward. New ManifestBlob registry (migration 0002) with bytes on disk
at instance/geenforce/payloads/<sha256> (deduped by content); service.store_blob
+ blob_path; client-facing GET /api/geenforce/payload/<sha256> (geenforce.fetch
token, ETag=hash, serves the blob store or an inline DB payload by hash). The
serializer now emits PayloadSource/PayloadSha256/PayloadRef for http/inline
entries only (smb entries round-trip unchanged - parity green). CLI
'flask geenforce add-payload <file>' registers a blob and prints its sha256.
This is the shopdb half (B1); the PS client/engine fetch is B2.

plugins/geenforce/serializer.py

@@ -73,6 +73,15 @@ def entry_to_dict(entry):
     for attr, key in _BOOL_FLAGS:
         if getattr(entry, attr):
             result[key] = True
+    # Payload transport for share-less (http/inline) delivery. Omitted for the
+    # default 'smb' source so existing share manifests round-trip unchanged; the
+    # client fetches GET /api/geenforce/payload/<PayloadSha256> for http/inline.
+    if entry.payloadsource and entry.payloadsource != 'smb':
+        result['PayloadSource'] = entry.payloadsource
+        if entry.payloadsha256:
+            result['PayloadSha256'] = entry.payloadsha256
+        if entry.payloadref:
+            result['PayloadRef'] = entry.payloadref
     # InUseCheck (nested object + Processes[]).
     if entry.inusecheck:
         procs = []