Address PR review: PXE gate + callback, git-sync templates, distro catalog, k8s targets, http+https

Implements the six review comments on PR #1:

- Per-host PXE-enable gate: read NetBox pxe_enabled custom field; a known host
  with it false gets the safe local-boot script (Cobbler netboot_enabled). Add a
  token-guarded POST /provisioned/{ident} callback that clears pxe_enabled in
  NetBox, plus a %post snippet in the default kickstarts that calls it.
- Templates from a git repo: bootapi clones a templates repo and re-pulls every
  BOOTAPI_TEMPLATE_GIT_INTERVAL (default 3m), atomically swapping the template
  set (last-good kept on parse failure; embedded defaults are the startup
  fallback). Metrics for syncs/failures/generation.
- Distro catalog (catalog/*.yaml): NetBox host -> boot images/kickstart, so
  adding an OS is a YAML + template change. Ships almalinux + fedora entries
  (artifactapi remotes); debian/talos path documented.
- Boot images from the artifactapi almalinux/fedora remotes via the catalog.
- Bind resolvers, puppet server/CA and PUPPETCA_URL env file now target the k8s
  services (198.18.200.7; puppet(ca).k8s.syd1.au.unkin.net).
- Boot path served over plain HTTP (installers lack CA trust) with an optional
  parallel HTTPS listener; docs say do not 301 the boot endpoints.

New packages: internal/catalog, internal/gitsync. NetBox client gains a
pxe_enabled write (token needs that scope - noted in docs). `bootapi validate`
subcommand validates a template/catalog set for the templates-repo CI.

go build/vet clean, go test -race green, golangci-lint v2 clean, pre-commit clean.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

internal/netbox/cache.go

@@ -15,7 +15,7 @@ import (
 // while keeping the data fresh enough that a re-provisioned host picks up
 // changes on its next boot.
 type Cache struct {
-	inner Resolver
+	inner API
 	ttl   time.Duration
 	now   func() time.Time // injectable for tests
 
@@ -38,7 +38,7 @@ type cacheEntry struct {
 }
 
 // NewCache wraps inner with a TTL cache. A non-positive ttl disables caching.
-func NewCache(inner Resolver, ttl time.Duration) *Cache {
+func NewCache(inner API, ttl time.Duration) *Cache {
 	return &Cache{
 		inner:   inner,
 		ttl:     ttl,
@@ -47,6 +47,19 @@ func NewCache(inner Resolver, ttl time.Duration) *Cache {
 	}
 }
 
+// SetPXEEnabled writes through to NetBox and drops the whole cache, so the next
+// /ipxe lookup reflects the flipped gate immediately rather than serving a
+// stale "enabled" host for up to the TTL.
+func (c *Cache) SetPXEEnabled(ctx context.Context, deviceID int, enabled bool) error {
+	if err := c.inner.SetPXEEnabled(ctx, deviceID, enabled); err != nil {
+		return err
+	}
+	c.mu.Lock()
+	clear(c.entries)
+	c.mu.Unlock()
+	return nil
+}
+
 // HostByMAC returns a cached host or resolves and caches one.
 func (c *Cache) HostByMAC(ctx context.Context, mac string) (*model.Host, error) {
 	return c.lookup(ctx, "mac:"+normalizeMAC(mac), func() (*model.Host, error) {