initial implementation: encapi ENC server + CLI

Postgres-backed External Node Classifier for Puppet, replacing Cobbler.
- encapi HTTP server (chi + pgx): read/write API + two ENC document shapes
  (reshaped for the exec terminus; cobbler-wire for enc_direct_facts.rb)
- encapi-cli: classify/node/role/status CRUD + import-cobbler seeder
- pkg/client Go SDK; unit tests across all packages (DB via testcontainers)
- Dockerfile (distroless), Makefile, nfpm RPM (encapi-cli + encapi-enc wrapper),
  Woodpecker CI, docs/cutover.md

docker-compose.yml

@@ -0,0 +1,38 @@
+services:
+  postgres:
+    image: postgres:17-alpine
+    environment:
+      POSTGRES_USER: encapi
+      POSTGRES_PASSWORD: encapi
+      POSTGRES_DB: encapi
+    ports:
+      - "5432:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U encapi"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+
+  encapi:
+    build:
+      context: .
+      args:
+        VERSION: dev
+    environment:
+      DBHOST: postgres
+      DBUSER: encapi
+      DBPASS: encapi
+      DBNAME: encapi
+      LISTEN_ADDR: ":8000"
+      # Set a token to enable writes; leave unset for read-only.
+      ENCAPI_WRITE_TOKEN: "${ENCAPI_WRITE_TOKEN:-devtoken}"
+    ports:
+      - "8000:8000"
+    depends_on:
+      postgres:
+        condition: service_healthy
+
+volumes:
+  pgdata: