feat: driver rename, driver icons, web image + driver search

Driver rename and icons: `Driver.display_name` plus a `DriverIcon` table, both
global/shared like the `Driver` row they hang off, so a rename or an icon is
what every Owner sees. The rename/icon dialog keeps its forms as siblings
(nested forms are invalid HTML) and the icon routes return an `hx-swap-oob`
thumbnail refresh rather than re-rendering the table, which would tear the open
`<dialog>` out of the DOM.

Web image picker: `GET /web/images` renders a pickable grid for a printer or a
driver icon, with the search term prefilled from the entity name and editable.
Picking one downloads it server-side and normalizes it.

Driver download search: `GET /web/drivers` searches for a vendor-wide driver
(the term is rewritten into the vendor's real product name for 15 brands) or for
the exact model as typed. Links only — nothing is downloaded, and the fragment
says the results are unvetted.

Icon uploads no longer reject off-size or non-PNG files: `normalize_icon()`
letterboxes any decodable raster into a 256x256 PNG. An already-exact 256x256
PNG is returned byte-identical, because icon storage is content-addressed and
re-encoding would move the file on every save.

`fetch_image()` makes the request from the server, so `assert_fetchable()`
refuses any URL resolving to a private, loopback, or link-local address, and
re-runs on every redirect. ImpTune sits on the same LAN as the printers it
configures; an unguarded fetcher would be a port scanner for anyone who can
reach the UI.

DuckDuckGo is scraped, not called through an API — no key needed, but fragile,
so both search functions swallow parse failures and return [] instead of 500ing
a page. `WEB_SEARCH=false` disables every outbound request and hides the
controls, for air-gapped installs.

Also: one shared `Jinja2Templates` in `templating.py` instead of five per-router
instances, so a template global is declared once; `_add_missing_columns()` in
`database.py` adds new nullable columns to a pre-existing table, which
`create_tables(safe=True)` skips; `db_env` in test_db.py now closes its
connection on teardown, or the next test's ORM writes land in the previous
test's DB file.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/test_driver_rename.py

@@ -0,0 +1,82 @@
+"""Driver rename — PATCH /drivers/{id}. Global/shared, like the Driver row."""
+from __future__ import annotations
+
+import json
+
+
+def _create_driver(**overrides):
+    from imptune.db.models import Driver
+
+    fields = {
+        "sha256": "a" * 64,
+        "original_filename": "hp_m404_x64.zip",
+        "size_bytes": 2048,
+        "driver_desc": json.dumps(["HP LaserJet M404 PCL-6"]),
+        "inf_filename": "hpm404.inf",
+        "architecture": "amd64",
+    }
+    fields.update(overrides)
+    return Driver.create(**fields)
+
+
+class TestDriverRename:
+    def test_sets_display_name(self, client, tmp_data_dir):
+        from imptune.db.models import Driver
+
+        driver = _create_driver()
+        response = client.patch(
+            f"/drivers/{driver.id}", data={"display_name": "HP UPD PCL6 (étage 2)"}
+        )
+        assert response.status_code == 200
+        assert Driver.get_by_id(driver.id).display_name == "HP UPD PCL6 (étage 2)"
+
+    def test_renamed_driver_shows_both_names_in_the_list(self, client, tmp_data_dir):
+        driver = _create_driver()
+        response = client.patch(
+            f"/drivers/{driver.id}", data={"display_name": "Accounting MFP"}
+        )
+        assert "Accounting MFP" in response.text
+        # The ZIP name stays visible as the sub-line — it is what is on disk.
+        assert "hp_m404_x64.zip" in response.text
+
+    def test_empty_value_clears_the_rename(self, client, tmp_data_dir):
+        from imptune.db.models import Driver
+
+        driver = _create_driver(display_name="Old label")
+        client.patch(f"/drivers/{driver.id}", data={"display_name": "   "})
+        assert Driver.get_by_id(driver.id).display_name is None
+
+    def test_rename_is_visible_to_another_owner(self, client, tmp_data_dir):
+        """Drivers are shared, so a rename is not scoped to the renamer."""
+        from fastapi.testclient import TestClient
+
+        from imptune.main import app
+
+        driver = _create_driver()
+        client.patch(f"/drivers/{driver.id}", data={"display_name": "Shared label"})
+
+        with TestClient(app) as other:  # fresh cookie jar → a different Owner
+            page = other.get("/drivers")
+        assert "Shared label" in page.text
+
+    def test_404_for_unknown_driver(self, client, tmp_data_dir):
+        response = client.patch("/drivers/99999", data={"display_name": "x"})
+        assert response.status_code == 404
+
+    def test_rejects_an_overlong_name(self, client, tmp_data_dir):
+        from imptune.db.models import Driver
+
+        driver = _create_driver()
+        response = client.patch(
+            f"/drivers/{driver.id}", data={"display_name": "x" * 121}
+        )
+        assert response.status_code == 400
+        assert Driver.get_by_id(driver.id).display_name is None
+
+    def test_missing_field_clears_rather_than_erroring(self, client, tmp_data_dir):
+        from imptune.db.models import Driver
+
+        driver = _create_driver(display_name="Old label")
+        response = client.patch(f"/drivers/{driver.id}", data={})
+        assert response.status_code == 200
+        assert Driver.get_by_id(driver.id).display_name is None