feat: add NetBox IP/interface facts with offline cache

Add a structured `netbox` fact that reads this node's IP/interface data
from NetBox, and profiles::netbox::facts to seed its credentials.

- netbox fact: queries NetBox (devices + VMs) by fqdn/hostname, emits
  interfaces (name, mac, ips, primary) and primary_ip.
- Caches every success to /var/cache/puppet-netbox/facts.json (0600).
  On any failure (short timeouts, DNS, non-200, parse) it serves the
  cached payload with cached=true; static IPs never change so stale is
  always safe. A never-cached host returns nothing; the fact never raises.
- profiles::netbox::facts: inert until $api_token is set; writes the
  root-only token/url files and the cache dir. Confined off (no-op) on
  hosts without the token. Included from profiles::base.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

site/profiles/manifests/base.pp

@@ -35,6 +35,7 @@ class profiles::base () {
     include profiles::ssh::service
     include profiles::cloudinit::init
     include profiles::helpers::node_lookup
+    include profiles::netbox::facts
     include profiles::consul::client
     include victorialogs::client::journald
 

site/profiles/manifests/netbox/facts.pp

@@ -0,0 +1,48 @@
+# profiles::netbox::facts
+#
+# Seeds the credentials the `netbox` custom fact needs to read this node's
+# IP/interface data from NetBox. Inert until $api_token is set: with no token
+# the fact is confined off (unenrolled hosts no-op).
+#
+# NetBox is authoritative and static IPs never change, so the fact caches every
+# successful response under $cache_dir forever and reuses it during a NetBox
+# outage - an outage can never fail a puppet run.
+class profiles::netbox::facts (
+  Optional[Sensitive[String]] $api_token  = undef,
+  Stdlib::HTTPSUrl            $url        = 'https://netbox.k8s.syd1.au.unkin.net',
+  Stdlib::AbsolutePath        $token_file = '/etc/puppetlabs/netbox.token',
+  Stdlib::AbsolutePath        $url_file   = '/etc/puppetlabs/netbox.url',
+  Stdlib::AbsolutePath        $cache_dir  = '/var/cache/puppet-netbox',
+) {
+
+  if $api_token =~ Undef {
+    notify { 'netbox-facts-inert':
+      message  => 'profiles::netbox::facts: api_token unset; netbox fact disabled on this host.',
+      loglevel => 'info',
+    }
+  } else {
+    file { $token_file:
+      ensure    => file,
+      owner     => 'root',
+      group     => 'root',
+      mode      => '0600',
+      show_diff => false,
+      content   => Sensitive("${api_token.unwrap}\n"),
+    }
+
+    file { $url_file:
+      ensure  => file,
+      owner   => 'root',
+      group   => 'root',
+      mode    => '0644',
+      content => "${url}\n",
+    }
+
+    file { $cache_dir:
+      ensure => directory,
+      owner  => 'root',
+      group  => 'root',
+      mode   => '0700',
+    }
+  }
+}