Address PR review: PXE gate + callback, git-sync templates, distro catalog, k8s targets, http+https

Implements the six review comments on PR #1:

- Per-host PXE-enable gate: read NetBox pxe_enabled custom field; a known host
  with it false gets the safe local-boot script (Cobbler netboot_enabled). Add a
  token-guarded POST /provisioned/{ident} callback that clears pxe_enabled in
  NetBox, plus a %post snippet in the default kickstarts that calls it.
- Templates from a git repo: bootapi clones a templates repo and re-pulls every
  BOOTAPI_TEMPLATE_GIT_INTERVAL (default 3m), atomically swapping the template
  set (last-good kept on parse failure; embedded defaults are the startup
  fallback). Metrics for syncs/failures/generation.
- Distro catalog (catalog/*.yaml): NetBox host -> boot images/kickstart, so
  adding an OS is a YAML + template change. Ships almalinux + fedora entries
  (artifactapi remotes); debian/talos path documented.
- Boot images from the artifactapi almalinux/fedora remotes via the catalog.
- Bind resolvers, puppet server/CA and PUPPETCA_URL env file now target the k8s
  services (198.18.200.7; puppet(ca).k8s.syd1.au.unkin.net).
- Boot path served over plain HTTP (installers lack CA trust) with an optional
  parallel HTTPS listener; docs say do not 301 the boot endpoints.

New packages: internal/catalog, internal/gitsync. NetBox client gains a
pxe_enabled write (token needs that scope - noted in docs). `bootapi validate`
subcommand validates a template/catalog set for the templates-repo CI.

go build/vet clean, go test -race green, golangci-lint v2 clean, pre-commit clean.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

internal/server/metrics.go

@@ -11,6 +11,13 @@ type cacheStats interface {
 	Misses() int64
 }
 
+// gitStats is the read side of the template git-syncer the collector publishes.
+type gitStats interface {
+	Syncs() int64
+	Failures() int64
+	Generation() int64
+}
+
 // metrics holds bootapi's Prometheus instruments, registered on a private
 // registry so tests can construct isolated servers.
 type metrics struct {
@@ -20,9 +27,11 @@ type metrics struct {
 	renders        *prometheus.CounterVec // by kind,result
 	netboxLookups  *prometheus.CounterVec // by field,result
 	netboxDuration *prometheus.HistogramVec
+	provisioned    *prometheus.CounterVec // by result
+	ipxeGated      prometheus.Counter
 }
 
-func newMetrics(cache cacheStats) *metrics {
+func newMetrics(cache cacheStats, git gitStats) *metrics {
 	reg := prometheus.NewRegistry()
 	m := &metrics{
 		reg: reg,
@@ -43,11 +52,22 @@ func newMetrics(cache cacheStats) *metrics {
 			Help:    "Latency of NetBox host resolutions.",
 			Buckets: prometheus.DefBuckets,
 		}, []string{"field"}),
+		provisioned: prometheus.NewCounterVec(prometheus.CounterOpts{
+			Name: "bootapi_provisioned_total",
+			Help: "Provisioned callbacks, by result (ok|unauthorized|notfound|error|disabled).",
+		}, []string{"result"}),
+		ipxeGated: prometheus.NewCounter(prometheus.CounterOpts{
+			Name: "bootapi_ipxe_gated_total",
+			Help: "Known hosts served the local-boot fallback because pxe_enabled=false.",
+		}),
 	}
-	reg.MustRegister(m.httpRequests, m.renders, m.netboxLookups, m.netboxDuration)
+	reg.MustRegister(m.httpRequests, m.renders, m.netboxLookups, m.netboxDuration, m.provisioned, m.ipxeGated)
 	if cache != nil {
 		reg.MustRegister(newCacheCollector(cache))
 	}
+	if git != nil {
+		reg.MustRegister(newGitCollector(git))
+	}
 	reg.MustRegister(
 		collectors.NewGoCollector(),
 		collectors.NewProcessCollector(collectors.ProcessCollectorOpts{}),
@@ -55,6 +75,35 @@ func newMetrics(cache cacheStats) *metrics {
 	return m
 }
 
+// gitCollector publishes the template git-syncer counters.
+type gitCollector struct {
+	stats      gitStats
+	syncs      *prometheus.Desc
+	failures   *prometheus.Desc
+	generation *prometheus.Desc
+}
+
+func newGitCollector(s gitStats) *gitCollector {
+	return &gitCollector{
+		stats:      s,
+		syncs:      prometheus.NewDesc("bootapi_template_sync_total", "Successful template reloads from git.", nil, nil),
+		failures:   prometheus.NewDesc("bootapi_template_sync_failures_total", "Template git pull/parse failures (last-good kept).", nil, nil),
+		generation: prometheus.NewDesc("bootapi_template_generation", "Monotonic counter of the active template generation.", nil, nil),
+	}
+}
+
+func (c *gitCollector) Describe(ch chan<- *prometheus.Desc) {
+	ch <- c.syncs
+	ch <- c.failures
+	ch <- c.generation
+}
+
+func (c *gitCollector) Collect(ch chan<- prometheus.Metric) {
+	ch <- prometheus.MustNewConstMetric(c.syncs, prometheus.CounterValue, float64(c.stats.Syncs()))
+	ch <- prometheus.MustNewConstMetric(c.failures, prometheus.CounterValue, float64(c.stats.Failures()))
+	ch <- prometheus.MustNewConstMetric(c.generation, prometheus.GaugeValue, float64(c.stats.Generation()))
+}
+
 // cacheCollector publishes the NetBox cache hit/miss counters, which live on
 // the Cache itself (atomic ints) rather than in a CounterVec.
 type cacheCollector struct {