Generalize USMT Dash and add a containerized demo mode

Remove all environment-specific data and make the dashboard adoptable
anywhere, then add a demo that runs the real PowerShell services.

- Strip cached device data, internal knowledge-base articles and
  screenshots, server/site names and the old project notes; replace the
  knowledge base with generic sample articles and diagrams
- Move every environment value into Config/usmt-dash.psd1
- Route all infrastructure access in the worker and Get-Software.ps1
  through a provider (Providers/SCCM.ps1), with a config-driven asset
  inventory view instead of a hard-coded custom class
- Add Providers/Demo.ps1: a deterministic simulated fleet whose
  migrations progress in real time, and Demo/New-DemoData.ps1 to seed it
- Server: -Demo makes the API read-only; add get-config and get-logs;
  serve static files only from web/, Documentation/ and an allowlist of
  Data/ files with a path-traversal guard; gzip large responses
- Mirror both services' console output to Data/Logs via a Write-Host
  proxy, and add a terminal panel to the dashboard that streams it
- Demo sandbox (web/demo/demo.js): visitor changes to tags, articles and
  images are kept in the visitor's browser and echoed in the terminals;
  nothing a visitor does reaches the server
- Vendor marked, highlight.js and html2pdf.js instead of loading CDNs
- Dockerfile and compose file for hosting the demo (Coolify-ready)

Documentation/Create Bootable USB.md

@@ -0,0 +1,22 @@
+[[Gray:Reference]]
+
+# Create a Bootable Imaging USB
+
+Use this when PXE isn't available (remote site, isolated network, or a device that won't PXE boot).
+
+## You'll Need
+- A USB drive of **32 GB or more** (it will be erased)
+- Access to the ConfigMgr console
+
+## Steps
+1. In the ConfigMgr console go to **Software Library > Operating Systems > Task Sequences**.
+2. Right-click the deployment task sequence > **Create Task Sequence Media**.
+3. Choose **Bootable media** > **Dynamic media**.
+4. Select **Removable USB drive** and pick the drive.
+5. Leave the media unprotected or set a password per team policy.
+6. Select the current production **boot image** and distribution point.
+7. Finish the wizard. Writing the media takes about 5-10 minutes.
+
+## Booting From It
+- Press the vendor boot-menu key (**F9** HP, **F12** Dell/Lenovo) and choose the USB device (UEFI).
+- If Secure Boot blocks the USB, confirm it was built from a signed boot image.