feat: memory-only sessions on HTTP, streamed exports, UI refresh

Session

- COOKIE_SECURE=false no longer persists the owner key for ten years.
  services/session.cookie_kwargs() drops max_age in that mode, so the
  browser holds the key in memory and the session ends with the window.
  Everything still persists server-side; only the browser link is
  temporary. base.html shows a warning banner (FR/EN) and an extra
  paragraph in the onboarding modal, and the README explains the
  trade-off and the backup-key escape hatch.
- Both cookie writers (middleware, POST /session/restore) go through
  cookie_kwargs() so the policy cannot drift between them.
- The CSRF guard on /session/restore compared request.url.scheme against
  the Origin header. Behind a TLS-terminating proxy uvicorn sees http
  while the browser sends https, so every legitimate restore was
  rejected with 403. It now compares hosts only, including
  X-Forwarded-Host.
- /static/*, /favicon.ico and /robots.txt skip the middleware. Each
  cookieless hit was inserting an Owner row no browser could ever use.

Reliability

- Malformed printer-form FK fields no longer escape as HTTP 500:
  a non-numeric client_id/driver_id raised ValueError and an unknown
  driver_id hit a FOREIGN KEY constraint. Both are now 400/404 HTMX
  fragments, and the duplicated field checks moved into
  _validate_fields().
- Package exports stream. build_intunewin() encrypts the inner ZIP in
  1 MB chunks against temp files with a streaming HMAC and SHA256, and
  both endpoints serve the result with FileResponse plus a background
  cleanup task. A 100 MB driver used to be held in memory three or four
  times over per concurrent download. The byte layout is unchanged.
- FileResponse also escapes the download filename, which was previously
  interpolated raw into Content-Disposition.
- python-multipart >= 0.0.18 (CVE-2024-53981, reachable from
  /drivers/upload) and Pillow >= 10.3 (CVE-2024-28219, reachable from
  icon upload).
- icons.py reads cfg.ICONS_DIR instead of re-deriving the path from
  DATA_DIR, matching the .intunewin export.

UI

- Sidebar/topbar shell, inline SVG icon macros (partials/icons.html),
  card and data-table components, grouped printer list, and the
  dedicated /printers/new page replacing partials/printer_form.html.

Tests

- 194 pass with a bare `pytest tests/`: tests/conftest.py now forces
  cfg.COOKIE_SECURE = False like the e2e conftest already did, so the
  Secure cookie is no longer dropped over http://testserver.
- New coverage for the malformed-FK guards, the chunk-boundary cases in
  the encrypt loop (every residue mod _CHUNK plus a multi-megabyte
  payload), temp-dir cleanup after both exports, and the whole
  COOKIE_SECURE matrix.
- test_printer_edit.py located the Edit button by its translated label,
  so it only passed on English-locale machines. It now targets the
  showModal() hook, which also cuts the e2e run from 84s to 15s.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

imptune/templates/printers.html

@@ -1,12 +1,49 @@
 {% extends "base.html" %}
+{% import "partials/icons.html" as ico %}
+
+{% block head_title %}Printers · ImpTune{% endblock %}
+{% block page_title %}<span x-data x-text="$store.i18n.t('printers')">Printers</span>{% endblock %}
+
+{% block page_actions %}
+<a href="/printers/new" class="btn sm">{{ ico.i('plus') }}<span x-text="$store.i18n.t('add_printer')">Add printer</span></a>
+{% endblock %}
 
 {% block content %}
-<h1 x-data x-text="$store.i18n.t('printers')">Printers</h1>
+<p class="page-intro" x-data x-text="$store.i18n.t('printers_intro')">A printer with a driver assigned is ready to export.</p>
 
-<p><a href="/printers/new" role="button" x-data x-text="$store.i18n.t('add_printer')">Add Printer</a></p>
+<div x-data="{
+       shown: 0,
+       total: 0,
+       recount() {
+         const rows = Array.from(document.querySelectorAll('#printer-list tr[data-search]'));
+         this.total = rows.length;
+         const q = this.$store.filter.q.trim().toLowerCase();
+         this.shown = q ? rows.filter(r => r.dataset.search.includes(q)).length : rows.length;
+       }
+     }"
+     x-init="recount()"
+     @htmx:after-swap.window="recount()">
+
+  <div class="toolbar">
+    <label class="search">
+      {{ ico.i('search') }}
+      <input type="search" x-model="$store.filter.q" @input="recount()"
+             :placeholder="$store.i18n.t('filter_printers')"
+             :aria-label="$store.i18n.t('filter_printers')">
+    </label>
+    <span class="filter-count" x-show="$store.filter.q.trim()" x-text="shown + ' / ' + total"></span>
+    <span class="spacer"></span>
+    {% if printer_count %}
+    <span class="badge ok">{{ ico.i('check', 12) }}{{ ready_count }}&nbsp;<span x-text="$store.i18n.t('ready_to_export')">Ready</span></span>
+    {% if printer_count - ready_count %}
+    <span class="badge warn">{{ ico.i('alert', 12) }}{{ printer_count - ready_count }}&nbsp;<span x-text="$store.i18n.t('needs_driver')">Driver needed</span></span>
+    {% endif %}
+    {% endif %}
+  </div>
 
-<section>
-  <h2 x-data x-text="$store.i18n.t('printer_library')">Printer Library</h2>
   {% include "partials/printer_list.html" %}
-</section>
+
+  <p class="empty-state" x-show="$store.filter.q.trim() && shown === 0" style="display:none"
+     x-text="$store.i18n.t('no_match')">No printer matches this filter.</p>
+</div>
 {% endblock %}