Fetch templates over HTTP instead of shelling out to git

The runtime image is distroless and has no git binary, so every sync
failed and bootapi silently served the stale embedded templates.

- fetch the branch tarball (<repo>/archive/<branch>.tar.gz) and extract
  it into an in-memory FS; no checkout, no writable volume
- digest the extracted tree, not the archive bytes, so a recompressed
  identical archive is not a change
- skip entries that would escape the tree
- log the source commit from Gitea's immutable Link header

docs/deployment.md

@@ -44,10 +44,9 @@ Create `apps/base/bootapi/` following the argocd-apps `AGENTS.md` pattern:
    as `BOOTAPI_NETBOX_TOKEN_FILE` / `BOOTAPI_PROVISION_TOKEN_FILE` /
    `BOOTAPI_ROOT_PASSWORD_HASH_FILE` (mount the Secret). Least-privilege
    securityContext (`runAsNonRoot`, `drop: [all]`). Baseline resources: requests
-   `512Mi`/`1`, limits `2Gi`/`2` cpu. The pod needs `git` on PATH for template
-   sync (the distroless image includes only the static binary — either add a git
-   layer, use an initContainer that seeds the checkout, or fall back to a
-   ConfigMap; simplest is a small alpine+git base for this service).
+   `512Mi`/`1`, limits `2Gi`/`2` cpu. No `git` binary and no writable volume
+   are needed: template sync is an HTTP fetch of the repo's branch tarball, held
+   in memory.
 6. **Service + exposure**: see the Gateway section below.
 7. Register in `argocd/applicationsets/platform.yaml` (`apps/overlays/*/bootapi`)
    and the platform AppProject destinations.