add POST /logs installer log relay to VictoriaLogs

A host being PXE-discovered or installed is not in Kubernetes, so vlagent
cannot collect its logs and a failed install leaves no record; the installer
environment has no internal-CA trust or credentials for the HTTPS log ingest,
and bootapi is already the plain-HTTP broker it can reach.

- add POST /logs, token-guarded like POST /provisioned, relaying ndjson to
  vlinsert's jsonline endpoint keyed on serial+phase
- stamp observed source IP and resolved NetBox device name into extra_fields
- return 202 on a sink failure so logs never block an install
- add BOOTAPI_VLINSERT_URL/_TIMEOUT and bootapi_log_relay metrics

config.example.env

@@ -55,6 +55,15 @@ BOOTAPI_ARTIFACT_BASE_URL=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remot
 BOOTAPI_PROVISION_TOKEN=
 # BOOTAPI_PROVISION_TOKEN_FILE=/var/run/secrets/bootapi/provision_token
 
+# --- installer log relay (POST /logs -> VictoriaLogs vlinsert) ---
+# A host being discovered or installed is not in k8s (no vlagent) and has no
+# internal-CA trust or credentials for the HTTPS log ingest, so bootapi relays
+# its newline-delimited JSON logs. Guarded by BOOTAPI_PROVISION_TOKEN.
+# An EMPTY value disables the endpoint (it then 503s).
+BOOTAPI_VLINSERT_URL=http://vlinsert-logs.logging.svc.cluster.local:9481
+# Short on purpose: logs are best-effort, an install must not wait on the sink.
+BOOTAPI_VLINSERT_TIMEOUT=5s
+
 # --- puppet bootstrap targets (k8s puppetserver; baked into kickstart %post) ---
 BOOTAPI_PUPPET_SERVER=puppet.k8s.syd1.au.unkin.net
 BOOTAPI_PUPPET_CA_SERVER=puppetca.k8s.syd1.au.unkin.net