feat: memory-only sessions on HTTP, streamed exports, UI refresh

Session

- COOKIE_SECURE=false no longer persists the owner key for ten years.
  services/session.cookie_kwargs() drops max_age in that mode, so the
  browser holds the key in memory and the session ends with the window.
  Everything still persists server-side; only the browser link is
  temporary. base.html shows a warning banner (FR/EN) and an extra
  paragraph in the onboarding modal, and the README explains the
  trade-off and the backup-key escape hatch.
- Both cookie writers (middleware, POST /session/restore) go through
  cookie_kwargs() so the policy cannot drift between them.
- The CSRF guard on /session/restore compared request.url.scheme against
  the Origin header. Behind a TLS-terminating proxy uvicorn sees http
  while the browser sends https, so every legitimate restore was
  rejected with 403. It now compares hosts only, including
  X-Forwarded-Host.
- /static/*, /favicon.ico and /robots.txt skip the middleware. Each
  cookieless hit was inserting an Owner row no browser could ever use.

Reliability

- Malformed printer-form FK fields no longer escape as HTTP 500:
  a non-numeric client_id/driver_id raised ValueError and an unknown
  driver_id hit a FOREIGN KEY constraint. Both are now 400/404 HTMX
  fragments, and the duplicated field checks moved into
  _validate_fields().
- Package exports stream. build_intunewin() encrypts the inner ZIP in
  1 MB chunks against temp files with a streaming HMAC and SHA256, and
  both endpoints serve the result with FileResponse plus a background
  cleanup task. A 100 MB driver used to be held in memory three or four
  times over per concurrent download. The byte layout is unchanged.
- FileResponse also escapes the download filename, which was previously
  interpolated raw into Content-Disposition.
- python-multipart >= 0.0.18 (CVE-2024-53981, reachable from
  /drivers/upload) and Pillow >= 10.3 (CVE-2024-28219, reachable from
  icon upload).
- icons.py reads cfg.ICONS_DIR instead of re-deriving the path from
  DATA_DIR, matching the .intunewin export.

UI

- Sidebar/topbar shell, inline SVG icon macros (partials/icons.html),
  card and data-table components, grouped printer list, and the
  dedicated /printers/new page replacing partials/printer_form.html.

Tests

- 194 pass with a bare `pytest tests/`: tests/conftest.py now forces
  cfg.COOKIE_SECURE = False like the e2e conftest already did, so the
  Secure cookie is no longer dropped over http://testserver.
- New coverage for the malformed-FK guards, the chunk-boundary cases in
  the encrypt loop (every residue mod _CHUNK plus a multi-megabyte
  payload), temp-dir cleanup after both exports, and the whole
  COOKIE_SECURE matrix.
- test_printer_edit.py located the Edit button by its translated label,
  so it only passed on English-locale machines. It now targets the
  showModal() hook, which also cuts the e2e run from 84s to 15s.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -48,7 +48,46 @@ parameters (`-Registry`, `-Owner`, `-Image`, `-NoBuild`, `-SkipLogin`, …).
 
 Set these under `environment:` in `docker-compose.yml`.
 
-| Variable   | Default | Purpose                                          |
-|------------|---------|--------------------------------------------------|
-| `DATA_DIR` | `/data` | Storage root for the SQLite DB, drivers and icons. Should map to the `imptune_data` volume. |
-| `PORT`     | `8000`  | Port the server listens on inside the container. |
+| Variable         | Default | Purpose                                          |
+|------------------|---------|--------------------------------------------------|
+| `DATA_DIR`       | `/data` | Storage root for the SQLite DB, drivers and icons. Should map to the `imptune_data` volume. |
+| `PORT`           | `8000`  | Port the server listens on inside the container. |
+| `COOKIE_SECURE`  | `true`  | `Secure` flag on the session cookie. Set to `false` when the app is reached over plain HTTP — see below. |
+
+### `COOKIE_SECURE` and HTTPS
+
+Printers, print defaults and clients belong to a session identified by an opaque
+key in a cookie (there are no accounts). That cookie is `Secure` by default, so
+it only travels over HTTPS.
+
+**Behind a TLS-terminating proxy** (nginx, Traefik, Caddy — the normal setup):
+leave the default. The session cookie lasts ten years, so a browser keeps its
+printers indefinitely.
+
+**Reached directly over plain HTTP** (`http://host:8000`): set
+`COOKIE_SECURE=false`, otherwise the browser refuses the cookie and every
+request starts a brand-new empty session — no printer you save is ever visible
+again.
+
+In that mode the app is fully usable and keeps remembering everything, but the
+cookie becomes **memory-only**: the session ends when the browser closes, and
+every page shows a warning saying so. This is deliberate — over plain HTTP the
+key is readable on the wire, so it is not written to disk for ten years. Use
+**Download my backup key** to save the key to a file; `/session/restore` takes
+it back on the next browser start, or on another machine.
+
+```yaml
+services:
+  imptune:
+    environment:
+      - DATA_DIR=/data
+      - COOKIE_SECURE=false   # only when serving plain HTTP
+```
+
+For local development the same applies:
+
+```bash
+export DATA_DIR=/tmp/imptune_data
+export COOKIE_SECURE=false
+uvicorn imptune.main:app --reload --port 8000
+```