v0.5.8: Windows ISOs just work (HTTP sanboot) + Storage UX

Windows boot, the "less is more" way. Windows ISOs now boot via iPXE
HTTP sanboot of the raw image — iPXE exposes the unmodified ISO as an
emulated CD backed by on-demand HTTP range reads, and Windows Setup
boots from it. This replaces the wimboot+SMB chain, which needed an SMB
server the host often can't provide (:445 collisions), served in-ISO
files via an ISO9660 lookup that failed on UDF-only Win11 ISOs, and was
gated behind a Settings toggle the WebUI never even exposed (so Windows
never booted). Now it needs only the HTTP port — works in any
environment, SMB or not — and nothing is injected into Windows (no
httpdisk.sys, no test certs, no trust-store changes; fully within the
project's hard rules).

- iso-store/store.rs: WindowsPe boot entry -> BootKind::SanBootIso of the
  raw iso/<id>.iso (render_entry already emits `sanboot --no-describe`).
- iso-store/introspect.rs: broaden Windows detection for UDF-only Win10/11
  ISOs — UTF-16LE markers (boot.wim/bootmgr/install.wim/microsoft),
  extra ASCII markers, and a filename heuristic, since their volume
  labels are cryptic and filenames are UTF-16. + unit tests.
- http-api/ipxe_script.rs: Windows installers submenu shows whenever a
  Windows ISO is present — no toggle, no "disabled in Settings".
- webui: dashboard no longer flags Windows ISOs (they boot now); the
  generic large-ISO warning reworded to read sensibly for genuinely
  non-bootable images (e.g. VMware VCSA appliance bundles).

Storage UX:
- Available images listed alphabetically by filename.
- Upload gains a Cancel button (aborts the chunk + discards the partial).
- beforeunload warning while an upload is in flight.

263 tests pass, clippy clean. NOTE: actual Windows boot is validated on
real hardware — code/script/range-serving are validated here.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/iso-store/src/store.rs

@@ -557,22 +557,22 @@ fn generate_boot_entries(id: &str, filename: &str, r: &IntrospectionReport) -> V
         .clone()
         .unwrap_or_else(|| filename.to_string());
     match r.family {
-        DistroFamily::WindowsPe if r.has_boot_wim => {
-            // Standard wimboot chain. Paths are in-ISO; the HTTP layer maps
-            // `iso/<id>/<path>` to on-disk extraction via ISO9660 lookup.
-            let base = format!("iso/{id}");
+        DistroFamily::WindowsPe => {
+            // v0.5.8: boot Windows directly via iPXE HTTP sanboot. iPXE
+            // exposes the raw ISO as an emulated CD backed by on-demand
+            // HTTP range reads, and Windows Setup boots from it. This
+            // replaces the old wimboot+SMB chain, which (a) needed an SMB
+            // server the host often can't provide (port 445 collisions),
+            // (b) served in-ISO files via an ISO9660 lookup that failed on
+            // UDF-only Windows 11 ISOs, and (c) required an operator
+            // toggle. sanboot needs none of that — just the HTTP port,
+            // which works in any environment. The unmodified, stock ISO is
+            // served at iso/<id>.iso; nothing is injected into Windows.
             vec![BootEntry {
-                id: format!("{id}-winpe"),
-                title: format!("{title} (Windows / wimboot)"),
-                kind: BootKind::Wimboot {
-                    wimboot_url: "ipxe/wimboot".to_string(),
-                    files: vec![
-                        ("bootmgr".into(), format!("{base}/bootmgr")),
-                        ("bootmgr.efi".into(), format!("{base}/bootmgr.efi")),
-                        ("bcd".into(), format!("{base}/boot/bcd")),
-                        ("boot.sdi".into(), format!("{base}/boot/boot.sdi")),
-                        ("boot.wim".into(), format!("{base}/sources/boot.wim")),
-                    ],
+                id: format!("{id}-windows"),
+                title: format!("{title} (Windows)"),
+                kind: BootKind::SanBootIso {
+                    iso_url: format!("iso/{id}.iso"),
                 },
             }]
         }