feat: driver rename, driver icons, web image + driver search

Driver rename and icons: `Driver.display_name` plus a `DriverIcon` table, both
global/shared like the `Driver` row they hang off, so a rename or an icon is
what every Owner sees. The rename/icon dialog keeps its forms as siblings
(nested forms are invalid HTML) and the icon routes return an `hx-swap-oob`
thumbnail refresh rather than re-rendering the table, which would tear the open
`<dialog>` out of the DOM.

Web image picker: `GET /web/images` renders a pickable grid for a printer or a
driver icon, with the search term prefilled from the entity name and editable.
Picking one downloads it server-side and normalizes it.

Driver download search: `GET /web/drivers` searches for a vendor-wide driver
(the term is rewritten into the vendor's real product name for 15 brands) or for
the exact model as typed. Links only — nothing is downloaded, and the fragment
says the results are unvetted.

Icon uploads no longer reject off-size or non-PNG files: `normalize_icon()`
letterboxes any decodable raster into a 256x256 PNG. An already-exact 256x256
PNG is returned byte-identical, because icon storage is content-addressed and
re-encoding would move the file on every save.

`fetch_image()` makes the request from the server, so `assert_fetchable()`
refuses any URL resolving to a private, loopback, or link-local address, and
re-runs on every redirect. ImpTune sits on the same LAN as the printers it
configures; an unguarded fetcher would be a port scanner for anyone who can
reach the UI.

DuckDuckGo is scraped, not called through an API — no key needed, but fragile,
so both search functions swallow parse failures and return [] instead of 500ing
a page. `WEB_SEARCH=false` disables every outbound request and hides the
controls, for air-gapped installs.

Also: one shared `Jinja2Templates` in `templating.py` instead of five per-router
instances, so a template global is declared once; `_add_missing_columns()` in
`database.py` adds new nullable columns to a pre-existing table, which
`create_tables(safe=True)` skips; `db_env` in test_db.py now closes its
connection on teardown, or the next test's ORM writes land in the previous
test's DB file.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/test_image_utils.py

@@ -0,0 +1,66 @@
+"""Icon normalization — anything decodable becomes a 256x256 PNG."""
+from __future__ import annotations
+
+import io
+
+import pytest
+from PIL import Image
+
+from imptune.services.image_utils import ICON_SIZE, ImageError, normalize_icon
+
+
+def _png(width: int, height: int, mode: str = "RGBA") -> bytes:
+    buf = io.BytesIO()
+    Image.new(mode, (width, height), color="red").save(buf, format="PNG")
+    return buf.getvalue()
+
+
+def _jpeg(width: int, height: int) -> bytes:
+    buf = io.BytesIO()
+    Image.new("RGB", (width, height), color="blue").save(buf, format="JPEG")
+    return buf.getvalue()
+
+
+def test_exact_png_passes_through_byte_identical():
+    """The icon store is content-addressed — re-encoding would move the file."""
+    data = _png(*ICON_SIZE)
+    assert normalize_icon(data) is data
+
+
+@pytest.mark.parametrize(
+    "source",
+    [_png(64, 64), _png(1024, 1024), _png(1024, 128), _jpeg(300, 200)],
+    ids=["small", "large", "wide", "jpeg"],
+)
+def test_everything_else_becomes_a_256_png(source):
+    out = normalize_icon(source)
+    with Image.open(io.BytesIO(out)) as img:
+        assert img.format == "PNG"
+        assert img.size == ICON_SIZE
+
+
+def test_aspect_ratio_is_kept_not_stretched():
+    """A 400x100 source keeps its 4:1 shape, letterboxed in a square canvas.
+
+    Checked through the alpha channel: the padding stays fully transparent, so
+    the opaque band is 64px tall in a 256px canvas.
+    """
+    out = normalize_icon(_png(400, 100))
+    with Image.open(io.BytesIO(out)) as img:
+        alpha = img.convert("RGBA").split()[3]
+        opaque_rows = [
+            y for y in range(256) if any(alpha.getpixel((x, y)) for x in range(256))
+        ]
+    assert len(opaque_rows) == 64
+    # ...and it is centered, not flush to the top.
+    assert opaque_rows[0] == 96
+
+
+def test_undecodable_bytes_raise():
+    with pytest.raises(ImageError):
+        normalize_icon(b"this is not an image")
+
+
+def test_empty_bytes_raise():
+    with pytest.raises(ImageError):
+        normalize_icon(b"")