feat: driver rename, driver icons, web image + driver search

Driver rename and icons: `Driver.display_name` plus a `DriverIcon` table, both
global/shared like the `Driver` row they hang off, so a rename or an icon is
what every Owner sees. The rename/icon dialog keeps its forms as siblings
(nested forms are invalid HTML) and the icon routes return an `hx-swap-oob`
thumbnail refresh rather than re-rendering the table, which would tear the open
`<dialog>` out of the DOM.

Web image picker: `GET /web/images` renders a pickable grid for a printer or a
driver icon, with the search term prefilled from the entity name and editable.
Picking one downloads it server-side and normalizes it.

Driver download search: `GET /web/drivers` searches for a vendor-wide driver
(the term is rewritten into the vendor's real product name for 15 brands) or for
the exact model as typed. Links only — nothing is downloaded, and the fragment
says the results are unvetted.

Icon uploads no longer reject off-size or non-PNG files: `normalize_icon()`
letterboxes any decodable raster into a 256x256 PNG. An already-exact 256x256
PNG is returned byte-identical, because icon storage is content-addressed and
re-encoding would move the file on every save.

`fetch_image()` makes the request from the server, so `assert_fetchable()`
refuses any URL resolving to a private, loopback, or link-local address, and
re-runs on every redirect. ImpTune sits on the same LAN as the printers it
configures; an unguarded fetcher would be a port scanner for anyone who can
reach the UI.

DuckDuckGo is scraped, not called through an API — no key needed, but fragile,
so both search functions swallow parse failures and return [] instead of 500ing
a page. `WEB_SEARCH=false` disables every outbound request and hides the
controls, for air-gapped installs.

Also: one shared `Jinja2Templates` in `templating.py` instead of five per-router
instances, so a template global is declared once; `_add_missing_columns()` in
`database.py` adds new nullable columns to a pre-existing table, which
`create_tables(safe=True)` skips; `db_env` in test_db.py now closes its
connection on teardown, or the next test's ORM writes land in the previous
test's DB file.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

imptune/services/image_utils.py

@@ -0,0 +1,50 @@
+"""Icon normalization — anything Pillow can decode becomes a 256x256 PNG.
+
+Intune wants exactly 256x256 PNG, but nothing a human picks (a photo from the
+web, a vendor logo, a screenshot) arrives that way. Rather than reject it, fit
+it into the box: aspect ratio preserved, transparent letterbox around it.
+"""
+from __future__ import annotations
+
+import io
+
+from PIL import Image, ImageOps, UnidentifiedImageError
+
+ICON_SIZE = (256, 256)
+
+
+class ImageError(ValueError):
+    """Raised when the bytes are not a decodable raster image."""
+
+
+def normalize_icon(data: bytes) -> bytes:
+    """Return `data` as exactly-256x256 PNG bytes.
+
+    A file that *already* is a 256x256 PNG is returned byte-identical — the
+    icon store is content-addressed by SHA256, so re-encoding an unchanged
+    upload would move it to a new path on every save for no reason.
+
+    Raises `ImageError` if the bytes cannot be decoded as an image.
+    """
+    try:
+        img = Image.open(io.BytesIO(data))
+        img.load()
+    except (UnidentifiedImageError, OSError, ValueError) as exc:
+        raise ImageError("Not a readable image file.") from exc
+
+    if img.format == "PNG" and img.size == ICON_SIZE:
+        return data
+
+    # `contain` scales down to fit inside the box without cropping; a smaller
+    # source is left at its own size rather than blown up into mush.
+    fitted = ImageOps.contain(img.convert("RGBA"), ICON_SIZE, Image.LANCZOS)
+
+    canvas = Image.new("RGBA", ICON_SIZE, (0, 0, 0, 0))
+    canvas.paste(
+        fitted,
+        ((ICON_SIZE[0] - fitted.width) // 2, (ICON_SIZE[1] - fitted.height) // 2),
+    )
+
+    out = io.BytesIO()
+    canvas.save(out, format="PNG", optimize=True)
+    return out.getvalue()