Address PR review: PXE gate + callback, git-sync templates, distro catalog, k8s targets, http+https

Implements the six review comments on PR #1:

- Per-host PXE-enable gate: read NetBox pxe_enabled custom field; a known host
  with it false gets the safe local-boot script (Cobbler netboot_enabled). Add a
  token-guarded POST /provisioned/{ident} callback that clears pxe_enabled in
  NetBox, plus a %post snippet in the default kickstarts that calls it.
- Templates from a git repo: bootapi clones a templates repo and re-pulls every
  BOOTAPI_TEMPLATE_GIT_INTERVAL (default 3m), atomically swapping the template
  set (last-good kept on parse failure; embedded defaults are the startup
  fallback). Metrics for syncs/failures/generation.
- Distro catalog (catalog/*.yaml): NetBox host -> boot images/kickstart, so
  adding an OS is a YAML + template change. Ships almalinux + fedora entries
  (artifactapi remotes); debian/talos path documented.
- Boot images from the artifactapi almalinux/fedora remotes via the catalog.
- Bind resolvers, puppet server/CA and PUPPETCA_URL env file now target the k8s
  services (198.18.200.7; puppet(ca).k8s.syd1.au.unkin.net).
- Boot path served over plain HTTP (installers lack CA trust) with an optional
  parallel HTTPS listener; docs say do not 301 the boot endpoints.

New packages: internal/catalog, internal/gitsync. NetBox client gains a
pxe_enabled write (token needs that scope - noted in docs). `bootapi validate`
subcommand validates a template/catalog set for the templates-repo CI.

go build/vet clean, go test -race green, golangci-lint v2 clean, pre-commit clean.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

internal/model/host.go

@@ -10,6 +10,10 @@ package model
 // zero value of a field means "NetBox did not provide it"; templates should
 // guard optional fields (e.g. Gateway) accordingly.
 type Host struct {
+	// DeviceID is the NetBox device id, used by the provisioned-callback to
+	// PATCH the pxe_enabled custom field.
+	DeviceID int
+
 	// Hostname is the short name (NetBox device name), e.g. "web01".
 	Hostname string
 	// Domain is the DNS domain the host lives in, e.g. "syd1.au.unkin.net".
@@ -57,12 +61,27 @@ type Host struct {
 	// bypassing platform/role selection. Sourced from a NetBox custom field.
 	TemplateOverride string
 
+	// PXEEnabled gates network install for this host, mirroring Cobbler's
+	// netboot_enabled. When false, bootapi serves the safe local-boot script
+	// from /ipxe even for a KNOWN host, so a provisioned machine does not
+	// re-install on its next PXE. nil means the NetBox custom field is unset,
+	// which is treated as ENABLED (a host without the field still installs).
+	// The end-of-kickstart callback (POST /provisioned) flips this to false.
+	PXEEnabled *bool
+
 	// Custom carries every NetBox custom field verbatim so templates can read
 	// site-specific knobs without a code change. Keys are the custom-field
 	// names as defined in NetBox.
 	Custom map[string]any
 }
 
+// ShouldPXEInstall reports whether bootapi should serve an installer boot script
+// for this host. Unset (nil) is treated as enabled so hosts predating the
+// custom field still provision.
+func (h *Host) ShouldPXEInstall() bool {
+	return h.PXEEnabled == nil || *h.PXEEnabled
+}
+
 // Interface is one network interface of a Host.
 type Interface struct {
 	// Name is the NetBox interface name, e.g. "eth0" / "bond0".