feat: memory-only sessions on HTTP, streamed exports, UI refresh

Session

- COOKIE_SECURE=false no longer persists the owner key for ten years.
  services/session.cookie_kwargs() drops max_age in that mode, so the
  browser holds the key in memory and the session ends with the window.
  Everything still persists server-side; only the browser link is
  temporary. base.html shows a warning banner (FR/EN) and an extra
  paragraph in the onboarding modal, and the README explains the
  trade-off and the backup-key escape hatch.
- Both cookie writers (middleware, POST /session/restore) go through
  cookie_kwargs() so the policy cannot drift between them.
- The CSRF guard on /session/restore compared request.url.scheme against
  the Origin header. Behind a TLS-terminating proxy uvicorn sees http
  while the browser sends https, so every legitimate restore was
  rejected with 403. It now compares hosts only, including
  X-Forwarded-Host.
- /static/*, /favicon.ico and /robots.txt skip the middleware. Each
  cookieless hit was inserting an Owner row no browser could ever use.

Reliability

- Malformed printer-form FK fields no longer escape as HTTP 500:
  a non-numeric client_id/driver_id raised ValueError and an unknown
  driver_id hit a FOREIGN KEY constraint. Both are now 400/404 HTMX
  fragments, and the duplicated field checks moved into
  _validate_fields().
- Package exports stream. build_intunewin() encrypts the inner ZIP in
  1 MB chunks against temp files with a streaming HMAC and SHA256, and
  both endpoints serve the result with FileResponse plus a background
  cleanup task. A 100 MB driver used to be held in memory three or four
  times over per concurrent download. The byte layout is unchanged.
- FileResponse also escapes the download filename, which was previously
  interpolated raw into Content-Disposition.
- python-multipart >= 0.0.18 (CVE-2024-53981, reachable from
  /drivers/upload) and Pillow >= 10.3 (CVE-2024-28219, reachable from
  icon upload).
- icons.py reads cfg.ICONS_DIR instead of re-deriving the path from
  DATA_DIR, matching the .intunewin export.

UI

- Sidebar/topbar shell, inline SVG icon macros (partials/icons.html),
  card and data-table components, grouped printer list, and the
  dedicated /printers/new page replacing partials/printer_form.html.

Tests

- 194 pass with a bare `pytest tests/`: tests/conftest.py now forces
  cfg.COOKIE_SECURE = False like the e2e conftest already did, so the
  Secure cookie is no longer dropped over http://testserver.
- New coverage for the malformed-FK guards, the chunk-boundary cases in
  the encrypt loop (every residue mod _CHUNK plus a multi-megabyte
  payload), temp-dir cleanup after both exports, and the whole
  COOKIE_SECURE matrix.
- test_printer_edit.py located the Edit button by its translated label,
  so it only passed on English-locale machines. It now targets the
  showModal() hook, which also cuts the e2e run from 84s to 15s.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

imptune/api/icons.py

@@ -6,7 +6,7 @@ import io
 from pathlib import Path
 
 from fastapi import APIRouter, Request, UploadFile
-from fastapi.responses import HTMLResponse
+from fastapi.responses import FileResponse, HTMLResponse, Response
 from PIL import Image
 
 import imptune.config as cfg
@@ -68,9 +68,11 @@ def upload_icon(request: Request, printer_id: int, file: UploadFile) -> HTMLResp
             status_code=422,
         )
 
-    # Store SHA256-addressed on disk
+    # Store SHA256-addressed on disk. cfg.ICONS_DIR is the same path the
+    # .intunewin export reads from — deriving it a second time from DATA_DIR
+    # would silently diverge if the layout ever changes.
     sha256 = hashlib.sha256(data).hexdigest()
-    icons_dir = Path(cfg.DATA_DIR) / "icons"
+    icons_dir = Path(cfg.ICONS_DIR)
     icons_dir.mkdir(parents=True, exist_ok=True)
     icon_path = icons_dir / sha256
     icon_path.write_bytes(data)
@@ -85,6 +87,37 @@ def upload_icon(request: Request, printer_id: int, file: UploadFile) -> HTMLResp
     )
 
     return HTMLResponse(
-        content="<p>Icon uploaded successfully</p>",
+        content=(
+            '<p class="ok-note">Icon uploaded successfully</p>'
+            f'<div class="icon-preview"><img src="/printers/{printer_id}/icon?v={sha256[:8]}"'
+            f' width="56" height="56" alt=""><span class="meta">{img.size[0]}&times;{img.size[1]} PNG</span></div>'
+        ),
         status_code=200,
     )
+
+
+@router.get("/{printer_id}/icon")
+def get_icon(request: Request, printer_id: int) -> Response:
+    """Serve the stored 256x256 PNG so the UI can show what was uploaded.
+
+    Owner-scoped: a printer belonging to another owner reads as missing.
+    """
+    printer = Printer.get_or_none(
+        (Printer.id == printer_id) & (Printer.owner == request.state.owner)
+    )
+    if printer is None:
+        return Response(status_code=404)
+
+    icon = Icon.get_or_none(Icon.printer == printer_id)
+    if icon is None:
+        return Response(status_code=404)
+
+    icon_path = Path(cfg.ICONS_DIR) / icon.sha256
+    if not icon_path.exists():
+        return Response(status_code=404)
+
+    return FileResponse(
+        icon_path,
+        media_type="image/png",
+        headers={"Cache-Control": "private, max-age=300"},
+    )