Generalize USMT Dash and add a containerized demo mode

Remove all environment-specific data and make the dashboard adoptable
anywhere, then add a demo that runs the real PowerShell services.

- Strip cached device data, internal knowledge-base articles and
  screenshots, server/site names and the old project notes; replace the
  knowledge base with generic sample articles and diagrams
- Move every environment value into Config/usmt-dash.psd1
- Route all infrastructure access in the worker and Get-Software.ps1
  through a provider (Providers/SCCM.ps1), with a config-driven asset
  inventory view instead of a hard-coded custom class
- Add Providers/Demo.ps1: a deterministic simulated fleet whose
  migrations progress in real time, and Demo/New-DemoData.ps1 to seed it
- Server: -Demo makes the API read-only; add get-config and get-logs;
  serve static files only from web/, Documentation/ and an allowlist of
  Data/ files with a path-traversal guard; gzip large responses
- Mirror both services' console output to Data/Logs via a Write-Host
  proxy, and add a terminal panel to the dashboard that streams it
- Demo sandbox (web/demo/demo.js): visitor changes to tags, articles and
  images are kept in the visitor's browser and echoed in the terminals;
  nothing a visitor does reaches the server
- Vendor marked, highlight.js and html2pdf.js instead of loading CDNs
- Dockerfile and compose file for hosting the demo (Coolify-ready)

Documentation/Manually Start USMT Backup.md

@@ -0,0 +1,16 @@
+[[Yellow:Remediation]]
+
+# Manually Start a USMT Backup
+
+Use this when a device in USMT Dash sits at **Not Started** while its replacement is ready.
+
+1. Find the device (the **Tracked Devices** or **USMT Status** page shows its last ping state).
+2. Restart it. The USMT backup won't start while another user is signed in. Then sign in.
+3. Open **Software Center**.
+   - Blank page or "failed to load"? Run [[Copy:C:\Windows\CCM\ccmrepair.exe]], wait for it to finish, then reopen Software Center.
+   - Still broken? Tag the device in USMT Dash (e.g. `Broken WMI`) and move on. See [WMI Namespace Fix](?doc=WMI%20Namespace%20Fix).
+4. Run **USMT Backup** from the *Operating Systems* tab.
+   - Fails immediately? Run `gpupdate /force`, then Software Center > Options > **Sync Policy**. Wait a few minutes and retry.
+5. When the button turns grey and shows *Installing...* the backup is running. You can sign out and move to the next device.
+
+In USMT Dash the row changes to **Backup In Progress** within one worker cycle, and the scanstate line shows progress.