Address PR review: PXE gate + callback, git-sync templates, distro catalog, k8s targets, http+https

Implements the six review comments on PR #1:

- Per-host PXE-enable gate: read NetBox pxe_enabled custom field; a known host
  with it false gets the safe local-boot script (Cobbler netboot_enabled). Add a
  token-guarded POST /provisioned/{ident} callback that clears pxe_enabled in
  NetBox, plus a %post snippet in the default kickstarts that calls it.
- Templates from a git repo: bootapi clones a templates repo and re-pulls every
  BOOTAPI_TEMPLATE_GIT_INTERVAL (default 3m), atomically swapping the template
  set (last-good kept on parse failure; embedded defaults are the startup
  fallback). Metrics for syncs/failures/generation.
- Distro catalog (catalog/*.yaml): NetBox host -> boot images/kickstart, so
  adding an OS is a YAML + template change. Ships almalinux + fedora entries
  (artifactapi remotes); debian/talos path documented.
- Boot images from the artifactapi almalinux/fedora remotes via the catalog.
- Bind resolvers, puppet server/CA and PUPPETCA_URL env file now target the k8s
  services (198.18.200.7; puppet(ca).k8s.syd1.au.unkin.net).
- Boot path served over plain HTTP (installers lack CA trust) with an optional
  parallel HTTPS listener; docs say do not 301 the boot endpoints.

New packages: internal/catalog, internal/gitsync. NetBox client gains a
pxe_enabled write (token needs that scope - noted in docs). `bootapi validate`
subcommand validates a template/catalog set for the templates-repo CI.

go build/vet clean, go test -race green, golangci-lint v2 clean, pre-commit clean.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

internal/config/config_test.go

@@ -22,12 +22,53 @@ func TestLoadDefaults(t *testing.T) {
 	if c.DefaultTemplate != "almalinux9" {
 		t.Errorf("DefaultTemplate = %q", c.DefaultTemplate)
 	}
-	if c.PuppetServer != "puppet.query.consul" || c.PuppetCAServer != "puppetca.query.consul" {
+	if c.PuppetServer != "puppet.k8s.syd1.au.unkin.net" || c.PuppetCAServer != "puppetca.k8s.syd1.au.unkin.net" {
 		t.Errorf("puppet servers = %q / %q", c.PuppetServer, c.PuppetCAServer)
 	}
+	if c.PuppetCAURL != "puppetca.k8s.syd1.au.unkin.net" {
+		t.Errorf("PuppetCAURL = %q", c.PuppetCAURL)
+	}
 	if c.UnknownMACFallback != "local" {
 		t.Errorf("UnknownMACFallback = %q", c.UnknownMACFallback)
 	}
+	if len(c.Nameservers) != 1 || c.Nameservers[0] != "198.18.200.7" {
+		t.Errorf("default nameservers = %v, want [198.18.200.7]", c.Nameservers)
+	}
+	if c.TemplateGitInterval != 3*time.Minute {
+		t.Errorf("TemplateGitInterval = %v, want 3m", c.TemplateGitInterval)
+	}
+	if c.ArtifactBaseURL != "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote" {
+		t.Errorf("ArtifactBaseURL = %q", c.ArtifactBaseURL)
+	}
+}
+
+func TestCallbackBaseDefaultsToBase(t *testing.T) {
+	clearEnv(t)
+	t.Setenv("BOOTAPI_BASE_URL", "http://bootapi.example.net/")
+	c, err := Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c.BaseURL != "http://bootapi.example.net" || c.CallbackBaseURL != "http://bootapi.example.net" {
+		t.Errorf("base=%q callback=%q; callback should default to base", c.BaseURL, c.CallbackBaseURL)
+	}
+}
+
+func TestProvisionTokenFile(t *testing.T) {
+	clearEnv(t)
+	dir := t.TempDir()
+	tf := filepath.Join(dir, "tok")
+	if err := os.WriteFile(tf, []byte(" prov-secret\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("BOOTAPI_PROVISION_TOKEN_FILE", tf)
+	c, err := Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c.ProvisionToken != "prov-secret" {
+		t.Errorf("ProvisionToken = %q", c.ProvisionToken)
+	}
 }
 
 func TestLoadTokenFile(t *testing.T) {