feat: memory-only sessions on HTTP, streamed exports, UI refresh

Session

- COOKIE_SECURE=false no longer persists the owner key for ten years.
  services/session.cookie_kwargs() drops max_age in that mode, so the
  browser holds the key in memory and the session ends with the window.
  Everything still persists server-side; only the browser link is
  temporary. base.html shows a warning banner (FR/EN) and an extra
  paragraph in the onboarding modal, and the README explains the
  trade-off and the backup-key escape hatch.
- Both cookie writers (middleware, POST /session/restore) go through
  cookie_kwargs() so the policy cannot drift between them.
- The CSRF guard on /session/restore compared request.url.scheme against
  the Origin header. Behind a TLS-terminating proxy uvicorn sees http
  while the browser sends https, so every legitimate restore was
  rejected with 403. It now compares hosts only, including
  X-Forwarded-Host.
- /static/*, /favicon.ico and /robots.txt skip the middleware. Each
  cookieless hit was inserting an Owner row no browser could ever use.

Reliability

- Malformed printer-form FK fields no longer escape as HTTP 500:
  a non-numeric client_id/driver_id raised ValueError and an unknown
  driver_id hit a FOREIGN KEY constraint. Both are now 400/404 HTMX
  fragments, and the duplicated field checks moved into
  _validate_fields().
- Package exports stream. build_intunewin() encrypts the inner ZIP in
  1 MB chunks against temp files with a streaming HMAC and SHA256, and
  both endpoints serve the result with FileResponse plus a background
  cleanup task. A 100 MB driver used to be held in memory three or four
  times over per concurrent download. The byte layout is unchanged.
- FileResponse also escapes the download filename, which was previously
  interpolated raw into Content-Disposition.
- python-multipart >= 0.0.18 (CVE-2024-53981, reachable from
  /drivers/upload) and Pillow >= 10.3 (CVE-2024-28219, reachable from
  icon upload).
- icons.py reads cfg.ICONS_DIR instead of re-deriving the path from
  DATA_DIR, matching the .intunewin export.

UI

- Sidebar/topbar shell, inline SVG icon macros (partials/icons.html),
  card and data-table components, grouped printer list, and the
  dedicated /printers/new page replacing partials/printer_form.html.

Tests

- 194 pass with a bare `pytest tests/`: tests/conftest.py now forces
  cfg.COOKIE_SECURE = False like the e2e conftest already did, so the
  Secure cookie is no longer dropped over http://testserver.
- New coverage for the malformed-FK guards, the chunk-boundary cases in
  the encrypt loop (every residue mod _CHUNK plus a multi-megabyte
  payload), temp-dir cleanup after both exports, and the whole
  COOKIE_SECURE matrix.
- test_printer_edit.py located the Edit button by its translated label,
  so it only passed on English-locale machines. It now targets the
  showModal() hook, which also cuts the e2e run from 84s to 15s.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/test_packages.py

@@ -256,3 +256,70 @@ class TestIntunewinIconInclusion:
         printer, _ = setup_printer_with_driver
         resp = client.get(f"/printers/{printer.id}/packages/intunewin")
         assert resp.status_code == 200
+
+
+# ---------------------------------------------------------------------------
+# Streamed exports — packages are assembled on disk, not buffered in RAM
+# ---------------------------------------------------------------------------
+
+
+class TestStreamedExportCleanup:
+    @pytest.fixture
+    def bulky_printer(self, tmp_data_dir, owner):
+        """Printer whose driver ZIP is large enough to prove the body streamed."""
+        import hashlib
+        import os
+
+        import imptune.config as cfg
+        from imptune.db.models import Driver, Printer
+
+        buf = io.BytesIO()
+        with zipfile.ZipFile(buf, "w") as zf:
+            zf.writestr("printer.inf", "[Version]\nSignature=$WINDOWS NT$\n")
+            zf.writestr("sub/payload.bin", os.urandom(200_000))
+        data = buf.getvalue()
+
+        sha = hashlib.sha256(data).hexdigest()
+        os.makedirs(cfg.DRIVERS_DIR, exist_ok=True)
+        with open(os.path.join(cfg.DRIVERS_DIR, f"{sha}.zip"), "wb") as f:
+            f.write(data)
+
+        driver = Driver.create(
+            sha256=sha,
+            original_filename="bulky.zip",
+            size_bytes=len(data),
+            driver_desc=json.dumps(["Acme SuperPrint"]),
+            inf_filename="printer.inf",
+        )
+        return Printer.create(
+            name="Bulky Printer",
+            ip_address="10.1.1.1",
+            port_name="IP_10.1.1.1",
+            owner=owner,
+            driver=driver,
+        )
+
+    @pytest.mark.parametrize("kind", ["ninja", "intunewin"])
+    def test_export_streams_and_removes_its_temp_dir(self, client, bulky_printer, kind):
+        """The response outlives the handler's temp dir, so a background task
+        deletes it — a leak here fills the container's disk one download at a time."""
+        import glob
+        import os
+        import tempfile
+
+        pattern = os.path.join(tempfile.gettempdir(), "imptune_*")
+        before = set(glob.glob(pattern))
+
+        resp = client.get(f"/printers/{bulky_printer.id}/packages/{kind}")
+
+        assert resp.status_code == 200
+        assert len(resp.content) > 150_000, "payload looks truncated"
+        assert set(glob.glob(pattern)) == before
+
+    def test_ninja_zip_preserves_nested_driver_paths(self, client, bulky_printer):
+        """Members are copied chunk-wise via ZipFile.open — nested paths must survive."""
+        resp = client.get(f"/printers/{bulky_printer.id}/packages/ninja")
+        with zipfile.ZipFile(io.BytesIO(resp.content)) as zf:
+            names = zf.namelist()
+            assert "Bulky_Printer/drivers/sub/payload.bin" in names
+            assert zf.getinfo("Bulky_Printer/drivers/sub/payload.bin").file_size == 200_000