add POST /logs installer log relay to VictoriaLogs

A host being PXE-discovered or installed is not in Kubernetes, so vlagent
cannot collect its logs and a failed install leaves no record; the installer
environment has no internal-CA trust or credentials for the HTTPS log ingest,
and bootapi is already the plain-HTTP broker it can reach.

- add POST /logs, token-guarded like POST /provisioned, relaying ndjson to
  vlinsert's jsonline endpoint keyed on serial+phase
- stamp observed source IP and resolved NetBox device name into extra_fields
- return 202 on a sink failure so logs never block an install
- add BOOTAPI_VLINSERT_URL/_TIMEOUT and bootapi_log_relay metrics

internal/config/config_test.go

@@ -40,6 +40,34 @@ func TestLoadDefaults(t *testing.T) {
 	if c.ArtifactBaseURL != "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote" {
 		t.Errorf("ArtifactBaseURL = %q", c.ArtifactBaseURL)
 	}
+	if c.VLInsertURL != "http://vlinsert-logs.logging.svc.cluster.local:9481" {
+		t.Errorf("VLInsertURL = %q", c.VLInsertURL)
+	}
+	if c.VLInsertTimeout != 5*time.Second {
+		t.Errorf("VLInsertTimeout = %v, want 5s", c.VLInsertTimeout)
+	}
+}
+
+func TestVLInsertURLEmptyDisablesRelay(t *testing.T) {
+	clearEnv(t)
+	// An explicitly empty value must NOT fall back to the default: it disables
+	// the /logs relay.
+	t.Setenv("BOOTAPI_VLINSERT_URL", "")
+	c, err := Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c.VLInsertURL != "" {
+		t.Errorf("VLInsertURL = %q, want empty (relay disabled)", c.VLInsertURL)
+	}
+}
+
+func TestVLInsertBadTimeout(t *testing.T) {
+	clearEnv(t)
+	t.Setenv("BOOTAPI_VLINSERT_TIMEOUT", "soon")
+	if _, err := Load(); err == nil {
+		t.Fatal("expected error for invalid BOOTAPI_VLINSERT_TIMEOUT")
+	}
 }
 
 func TestCallbackBaseDefaultsToBase(t *testing.T) {