add POST /logs installer log relay to VictoriaLogs

A host being PXE-discovered or installed is not in Kubernetes, so vlagent
cannot collect its logs and a failed install leaves no record; the installer
environment has no internal-CA trust or credentials for the HTTPS log ingest,
and bootapi is already the plain-HTTP broker it can reach.

- add POST /logs, token-guarded like POST /provisioned, relaying ndjson to
  vlinsert's jsonline endpoint keyed on serial+phase
- stamp observed source IP and resolved NetBox device name into extra_fields
- return 202 on a sink failure so logs never block an install
- add BOOTAPI_VLINSERT_URL/_TIMEOUT and bootapi_log_relay metrics

README.md

@@ -33,6 +33,7 @@ serves it. Templates are embedded defaults, overridable from a directory
 | `GET /ipxe/{mac}` · `GET /boot/ipxe?mac=` | iPXE boot script |
 | `GET /ks/{ident}` | rendered kickstart (MAC or hostname) |
 | `POST /provisioned/{ident}` | end-of-kickstart callback (token) → clears `pxe_enabled` in NetBox |
+| `POST /logs` | installer log relay (token) → VictoriaLogs `vlinsert` |
 | `GET /healthz` · `/readyz` · `/metrics` | health + Prometheus |
 
 The boot path is served over **plain HTTP** (PXE installers have no internal-CA
@@ -64,7 +65,7 @@ rationale in [docs/endpoints.md](docs/endpoints.md).
 Env-based (12-factor), see [`config.example.env`](config.example.env). Key vars:
 `BOOTAPI_NETBOX_URL`, `BOOTAPI_NETBOX_TOKEN[_FILE]`, `BOOTAPI_BASE_URL`,
 `BOOTAPI_BOOT_BASE_URL`, `BOOTAPI_ROOT_PASSWORD_HASH[_FILE]`,
-`BOOTAPI_UNKNOWN_MAC_FALLBACK`.
+`BOOTAPI_UNKNOWN_MAC_FALLBACK`, `BOOTAPI_VLINSERT_URL`.
 
 ## Development