v0.5.8: Windows ISOs just work (HTTP sanboot) + Storage UX

Windows boot, the "less is more" way. Windows ISOs now boot via iPXE
HTTP sanboot of the raw image — iPXE exposes the unmodified ISO as an
emulated CD backed by on-demand HTTP range reads, and Windows Setup
boots from it. This replaces the wimboot+SMB chain, which needed an SMB
server the host often can't provide (:445 collisions), served in-ISO
files via an ISO9660 lookup that failed on UDF-only Win11 ISOs, and was
gated behind a Settings toggle the WebUI never even exposed (so Windows
never booted). Now it needs only the HTTP port — works in any
environment, SMB or not — and nothing is injected into Windows (no
httpdisk.sys, no test certs, no trust-store changes; fully within the
project's hard rules).

- iso-store/store.rs: WindowsPe boot entry -> BootKind::SanBootIso of the
  raw iso/<id>.iso (render_entry already emits `sanboot --no-describe`).
- iso-store/introspect.rs: broaden Windows detection for UDF-only Win10/11
  ISOs — UTF-16LE markers (boot.wim/bootmgr/install.wim/microsoft),
  extra ASCII markers, and a filename heuristic, since their volume
  labels are cryptic and filenames are UTF-16. + unit tests.
- http-api/ipxe_script.rs: Windows installers submenu shows whenever a
  Windows ISO is present — no toggle, no "disabled in Settings".
- webui: dashboard no longer flags Windows ISOs (they boot now); the
  generic large-ISO warning reworded to read sensibly for genuinely
  non-bootable images (e.g. VMware VCSA appliance bundles).

Storage UX:
- Available images listed alphabetically by filename.
- Upload gains a Cancel button (aborts the chunk + discards the partial).
- beforeunload warning while an upload is in flight.

263 tests pass, clippy clean. NOTE: actual Windows boot is validated on
real hardware — code/script/range-serving are validated here.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Cargo.lock

@@ -2669,7 +2669,7 @@ checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
 [[package]]
 name = "openpxe"
-version = "0.5.7"
+version = "0.5.8"
 dependencies = [
  "anyhow",
  "axum",
@@ -2691,7 +2691,7 @@ dependencies = [
 
 [[package]]
 name = "openpxe-core"
-version = "0.5.7"
+version = "0.5.8"
 dependencies = [
  "anyhow",
  "base64",
@@ -2718,7 +2718,7 @@ dependencies = [
 
 [[package]]
 name = "openpxe-dhcp-proxy"
-version = "0.5.7"
+version = "0.5.8"
 dependencies = [
  "anyhow",
  "bytes",
@@ -2732,7 +2732,7 @@ dependencies = [
 
 [[package]]
 name = "openpxe-http-api"
-version = "0.5.7"
+version = "0.5.8"
 dependencies = [
  "anyhow",
  "axum",
@@ -2768,7 +2768,7 @@ dependencies = [
 
 [[package]]
 name = "openpxe-ipxe-assets"
-version = "0.5.7"
+version = "0.5.8"
 dependencies = [
  "openpxe-core",
  "rust-embed",
@@ -2778,7 +2778,7 @@ dependencies = [
 
 [[package]]
 name = "openpxe-iso-store"
-version = "0.5.7"
+version = "0.5.8"
 dependencies = [
  "anyhow",
  "bcrypt",
@@ -2807,7 +2807,7 @@ dependencies = [
 
 [[package]]
 name = "openpxe-tftp"
-version = "0.5.7"
+version = "0.5.8"
 dependencies = [
  "anyhow",
  "bytes",
@@ -2821,7 +2821,7 @@ dependencies = [
 
 [[package]]
 name = "openpxe-webui"
-version = "0.5.7"
+version = "0.5.8"
 
 [[package]]
 name = "p256"