Fetch templates over HTTP instead of shelling out to git

The runtime image is distroless and has no git binary, so every sync
failed and bootapi silently served the stale embedded templates.

- fetch the branch tarball (<repo>/archive/<branch>.tar.gz) and extract
  it into an in-memory FS; no checkout, no writable volume
- digest the extracted tree, not the archive bytes, so a recompressed
  identical archive is not a change
- skip entries that would escape the tree
- log the source commit from Gitea's immutable Link header

docs/template-authoring.md

@@ -8,7 +8,8 @@ bootapi ships an embedded default set and lets you override or extend it.
   `templates/ipxe/*.ipxe.tmpl` and `templates/catalog/*.yaml`, compiled into the
   binary (`templates/embed.go`). These are the always-available startup fallback.
 - **Template git repo** (preferred in prod): `BOOTAPI_TEMPLATE_GIT_URL`. bootapi
-  clones it at startup and re-pulls every `BOOTAPI_TEMPLATE_GIT_INTERVAL`
+  fetches the branch tarball (`<repo>/archive/<branch>.tar.gz`) over HTTP at
+  startup and re-fetches every `BOOTAPI_TEMPLATE_GIT_INTERVAL`
   (default 3m, like argocd), atomically swapping the loaded set on change. A
   parse failure keeps the **last-good** set and is only logged + counted
   (`bootapi_template_sync_failures_total`), so a bad push can't take bootapi