Initial bootapi: NetBox-driven PXE/kickstart boot service

bootapi replaces Cobbler's PXE/kickstart side. It resolves a PXE-booting host
from NetBox (by MAC or hostname), renders an iPXE boot script and a kickstart
from Go text/templates, and serves them over HTTP. The ENC half already moved to
encapi; this covers the provisioning/boot half.

What's here:
- cmd/bootapi + internal/{config,model,netbox,render,server}; embedded default
  templates under templates/ (AlmaLinux 9 + Fedora kickstarts, iPXE boot +
  unknown-MAC fallbacks) ported from Cobbler's boot/bootstrap contract.
- NetBox client (v4.x API) behind a Resolver interface with a short-TTL cache;
  tested against httptest fixtures using real NetBox JSON shapes.
- chi HTTP server: /ipxe/{mac}, /boot/ipxe?mac=, /ks/{ident}, healthz/readyz,
  Prometheus /metrics. Unknown MAC -> safe fallback iPXE (200), unknown KS -> 404.
- Secrets (root pw hash, ssh keys) injected at render time from env/Vault, never
  NetBox. Config is env-based per estate convention.
- Makefile (build/test/lint/docker + patch/minor/major), Dockerfile (distroless),
  .woodpecker (pre-commit, golangci-lint v2 + go test -race, docker build on PR;
  image push + Gitea binary release on v* tag), docs/ and example config.

go build/vet clean, go test -race green, golangci-lint v2 clean, pre-commit clean.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

internal/netbox/cache_test.go

@@ -0,0 +1,87 @@
+package netbox
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"testing"
+	"time"
+
+	"git.unkin.net/unkin/bootapi/internal/model"
+)
+
+// countingResolver records how many times the underlying resolver is hit.
+type countingResolver struct {
+	mu    sync.Mutex
+	calls int
+	host  *model.Host
+	err   error
+}
+
+func (c *countingResolver) HostByMAC(context.Context, string) (*model.Host, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.calls++
+	return c.host, c.err
+}
+func (c *countingResolver) HostByName(context.Context, string) (*model.Host, error) {
+	return c.HostByMAC(context.Background(), "")
+}
+
+func TestCacheHitAndExpiry(t *testing.T) {
+	inner := &countingResolver{host: &model.Host{Hostname: "web01"}}
+	cache := NewCache(inner, time.Minute)
+
+	now := time.Unix(1000, 0)
+	cache.now = func() time.Time { return now }
+
+	// First call misses and resolves.
+	if _, err := cache.HostByMAC(context.Background(), "aa:bb:cc:00:11:22"); err != nil {
+		t.Fatal(err)
+	}
+	// Second call within TTL is a hit; the inner resolver is not called again.
+	if _, err := cache.HostByMAC(context.Background(), "AA:BB:CC:00:11:22"); err != nil {
+		t.Fatal(err)
+	}
+	if inner.calls != 1 {
+		t.Fatalf("inner calls = %d, want 1 (second served from cache)", inner.calls)
+	}
+	if cache.Hits() != 1 || cache.Misses() != 1 {
+		t.Fatalf("hits=%d misses=%d, want 1/1", cache.Hits(), cache.Misses())
+	}
+
+	// Advance past the TTL -> next call misses and re-resolves.
+	now = now.Add(2 * time.Minute)
+	if _, err := cache.HostByMAC(context.Background(), "aa:bb:cc:00:11:22"); err != nil {
+		t.Fatal(err)
+	}
+	if inner.calls != 2 {
+		t.Fatalf("inner calls = %d, want 2 after expiry", inner.calls)
+	}
+}
+
+func TestCacheDisabled(t *testing.T) {
+	inner := &countingResolver{host: &model.Host{Hostname: "web01"}}
+	cache := NewCache(inner, 0) // ttl <= 0 disables caching
+	for i := 0; i < 3; i++ {
+		if _, err := cache.HostByMAC(context.Background(), "aa:bb:cc:00:11:22"); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if inner.calls != 3 {
+		t.Fatalf("inner calls = %d, want 3 (cache disabled)", inner.calls)
+	}
+}
+
+func TestCacheDoesNotCacheErrors(t *testing.T) {
+	inner := &countingResolver{err: ErrNotFound}
+	cache := NewCache(inner, time.Minute)
+	for i := 0; i < 2; i++ {
+		if _, err := cache.HostByMAC(context.Background(), "de:ad:be:ef:00:00"); !errors.Is(err, ErrNotFound) {
+			t.Fatalf("err = %v, want ErrNotFound", err)
+		}
+	}
+	if inner.calls != 2 {
+		t.Fatalf("inner calls = %d, want 2 (errors are not cached)", inner.calls)
+	}
+}