feat: memory-only sessions on HTTP, streamed exports, UI refresh

Session

- COOKIE_SECURE=false no longer persists the owner key for ten years.
  services/session.cookie_kwargs() drops max_age in that mode, so the
  browser holds the key in memory and the session ends with the window.
  Everything still persists server-side; only the browser link is
  temporary. base.html shows a warning banner (FR/EN) and an extra
  paragraph in the onboarding modal, and the README explains the
  trade-off and the backup-key escape hatch.
- Both cookie writers (middleware, POST /session/restore) go through
  cookie_kwargs() so the policy cannot drift between them.
- The CSRF guard on /session/restore compared request.url.scheme against
  the Origin header. Behind a TLS-terminating proxy uvicorn sees http
  while the browser sends https, so every legitimate restore was
  rejected with 403. It now compares hosts only, including
  X-Forwarded-Host.
- /static/*, /favicon.ico and /robots.txt skip the middleware. Each
  cookieless hit was inserting an Owner row no browser could ever use.

Reliability

- Malformed printer-form FK fields no longer escape as HTTP 500:
  a non-numeric client_id/driver_id raised ValueError and an unknown
  driver_id hit a FOREIGN KEY constraint. Both are now 400/404 HTMX
  fragments, and the duplicated field checks moved into
  _validate_fields().
- Package exports stream. build_intunewin() encrypts the inner ZIP in
  1 MB chunks against temp files with a streaming HMAC and SHA256, and
  both endpoints serve the result with FileResponse plus a background
  cleanup task. A 100 MB driver used to be held in memory three or four
  times over per concurrent download. The byte layout is unchanged.
- FileResponse also escapes the download filename, which was previously
  interpolated raw into Content-Disposition.
- python-multipart >= 0.0.18 (CVE-2024-53981, reachable from
  /drivers/upload) and Pillow >= 10.3 (CVE-2024-28219, reachable from
  icon upload).
- icons.py reads cfg.ICONS_DIR instead of re-deriving the path from
  DATA_DIR, matching the .intunewin export.

UI

- Sidebar/topbar shell, inline SVG icon macros (partials/icons.html),
  card and data-table components, grouped printer list, and the
  dedicated /printers/new page replacing partials/printer_form.html.

Tests

- 194 pass with a bare `pytest tests/`: tests/conftest.py now forces
  cfg.COOKIE_SECURE = False like the e2e conftest already did, so the
  Secure cookie is no longer dropped over http://testserver.
- New coverage for the malformed-FK guards, the chunk-boundary cases in
  the encrypt loop (every residue mod _CHUNK plus a multi-megabyte
  payload), temp-dir cleanup after both exports, and the whole
  COOKIE_SECURE matrix.
- test_printer_edit.py located the Edit button by its translated label,
  so it only passed on English-locale machines. It now targets the
  showModal() hook, which also cuts the e2e run from 84s to 15s.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/test_intunewin.py

@@ -281,3 +281,71 @@ class TestCryptographicVerification:
         assert xml_size == len(plaintext), (
             f"UnencryptedContentSize {xml_size} does not match actual plaintext size {len(plaintext)}"
         )
+
+
+class TestStreamingChunkBoundaries:
+    """The builder encrypts the inner ZIP in _CHUNK-sized pieces rather than in
+    one buffer. Only the final (short) read carries PKCS7 padding, so a payload
+    landing exactly on a chunk boundary is the case that breaks first."""
+
+    @staticmethod
+    def _decrypt(built_package):
+        with zipfile.ZipFile(built_package, "r") as outer:
+            blob = outer.read("IntuneWinPackage/Contents/IntunePackage.intunewin")
+            tree = ET.fromstring(
+                outer.read("IntuneWinPackage/Metadata/Detection.xml").decode("utf-8")
+            )
+        aes_key = base64.b64decode(_get_enc_text(tree, "EncryptionKey"))
+        iv = base64.b64decode(_get_enc_text(tree, "InitializationVector"))
+        cipher = AES.new(aes_key, AES.MODE_CBC, iv)
+        plaintext = unpad(cipher.decrypt(blob[48:]), AES.block_size)
+
+        # MAC covers IV || ciphertext and must survive chunked hashing
+        mac_key = base64.b64decode(_get_enc_text(tree, "MacKey"))
+        assert hmac.new(mac_key, blob[32:], hashlib.sha256).digest() == blob[:32]
+        # Metadata is computed while streaming, not from a buffered plaintext
+        assert base64.b64decode(_get_enc_text(tree, "FileDigest")) == hashlib.sha256(plaintext).digest()
+        assert int(_get_xml_text(tree, "UnencryptedContentSize")) == len(plaintext)
+        return plaintext
+
+    @pytest.mark.parametrize("payload_size", range(96, 128))
+    def test_every_residue_of_chunk_size(self, tmp_path, monkeypatch, payload_size):
+        """Sweep 32 consecutive sizes with a 16-byte chunk so every offset mod
+        _CHUNK is exercised, including the exact-multiple case where the last
+        read returns b"" and padding is a whole standalone block."""
+        monkeypatch.setattr("imptune.generators.intunewin_builder._CHUNK", 16)
+
+        src = tmp_path / "src"
+        src.mkdir()
+        # Incompressible, so inner-ZIP size tracks payload size 1:1
+        (src / "install.ps1").write_bytes(os.urandom(payload_size))
+        output = str(tmp_path / "package.intunewin")
+
+        build_intunewin(str(src), "install.ps1", output)
+        plaintext = self._decrypt(output)
+        assert zipfile.is_zipfile(io.BytesIO(plaintext))
+
+    def test_multi_megabyte_payload_roundtrips(self, tmp_path):
+        """Several full 1 MB chunks through the default code path."""
+        src = tmp_path / "src"
+        src.mkdir()
+        blob = os.urandom(2_500_000)
+        (src / "install.ps1").write_text("Write-Host 'go'")
+        (src / "driver.bin").write_bytes(blob)
+        output = str(tmp_path / "package.intunewin")
+
+        build_intunewin(str(src), "install.ps1", output)
+        plaintext = self._decrypt(output)
+
+        with zipfile.ZipFile(io.BytesIO(plaintext)) as inner:
+            assert inner.read("driver.bin") == blob
+
+
+class TestArgumentValidation:
+    def test_missing_source_dir_raises(self, tmp_path):
+        with pytest.raises(FileNotFoundError):
+            build_intunewin(str(tmp_path / "nope"), "install.ps1", str(tmp_path / "o.intunewin"))
+
+    def test_empty_setup_file_raises(self, source_dir, tmp_path):
+        with pytest.raises(ValueError):
+            build_intunewin(source_dir, "", str(tmp_path / "o.intunewin"))