feat(06-01): wire icon into .intunewin staging before build

- Add shutil import and Icon import to packages.py
- After driver extraction, look up Icon record for printer
- If found and file exists on disk, copy to tmpdir/icon.png
- Missing icon (no DB record or missing file) silently skipped — export still succeeds
- PKG-04 requirement satisfied

imptune/api/packages.py

@@ -2,6 +2,7 @@
 import io
 import json
 import os
+import shutil
 import tempfile
 import zipfile
 
@@ -9,7 +10,7 @@ from fastapi import APIRouter
 from fastapi.responses import PlainTextResponse, Response
 
 import imptune.config as cfg
-from imptune.db.models import Printer
+from imptune.db.models import Icon, Printer
 from imptune.generators.intunewin_builder import build_intunewin
 from imptune.generators.script_generator import render_detect, render_install, render_uninstall
 
@@ -144,6 +145,13 @@ def get_intunewin_package(printer_id: int):
         with zipfile.ZipFile(driver_zip_path, "r") as driver_zf:
             driver_zf.extractall(drivers_subdir)
 
+        # Copy icon into staging if one exists for this printer
+        icon_record = Icon.get_or_none(Icon.printer == printer.id)
+        if icon_record is not None:
+            icon_src = os.path.join(cfg.ICONS_DIR, icon_record.sha256)
+            if os.path.isfile(icon_src):
+                shutil.copy2(icon_src, os.path.join(tmpdir, "icon.png"))
+
         # Build .intunewin
         output_path = os.path.join(tmpdir, "out.intunewin")
         build_intunewin(tmpdir, "install.ps1", output_path)