Add terraform-provider-kea

Terraform/OpenTofu provider wrapping the kea-operator KeaAPI, modelled on
terraform-provider-encapi.

- add kea_subnet and kea_clientclass resources with full CRUD over the
  PUT/GET/DELETE /api/v1/{subnets,clientclasses}/{name} contract
- add provider config (endpoint + bearer token, KEA_API_TOKEN fallback);
  404 on read removes the resource from state
- add unit tests against httptest mock servers (client, wire round-trip,
  type conversions, schemas)
- add Makefile (patch|minor|major + package) and .woodpecker CI mirroring
  terraform-provider-encapi; tag release PUTs the zip to the artifactapi
  terraform-unkin registry under unkin/kea

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

examples/main.tf

@@ -0,0 +1,42 @@
+terraform {
+  required_providers {
+    kea = {
+      source  = "git.unkin.net/unkin/kea"
+      version = "0.0.1"
+    }
+  }
+}
+
+provider "kea" {
+  endpoint = "https://keaapi.k8s.syd1.au.unkin.net"
+  # token defaults to the KEA_API_TOKEN environment variable
+}
+
+resource "kea_clientclass" "pxeclients" {
+  name = "pxeclients"
+  test = "substring(option[60].hex,0,9) == 'PXEClient'"
+
+  next_server    = "10.0.0.1"
+  boot_file_name = "ipxe.efi"
+}
+
+resource "kea_subnet" "lab" {
+  name        = "lab"
+  cluster_ref = "primary"
+  subnet      = "10.0.0.0/24"
+
+  pools          = ["10.0.0.100-10.0.0.200"]
+  routers        = ["10.0.0.1"]
+  dns_servers    = ["10.0.0.53"]
+  domain_name    = "lab.unkin.net"
+  client_classes = [kea_clientclass.pxeclients.name]
+  valid_lifetime = 3600
+
+  option_data = [
+    {
+      name = "tftp-server-name"
+      code = 66
+      data = "10.0.0.1"
+    },
+  ]
+}

examples/resources/kea_clientclass/main.tf

@@ -0,0 +1,17 @@
+resource "kea_clientclass" "pxeclients" {
+  name = "pxeclients"
+
+  # Match legacy BIOS PXE clients by vendor-class-identifier.
+  test = "substring(option[60].hex,0,9) == 'PXEClient'"
+
+  next_server    = "10.0.0.1"
+  boot_file_name = "ipxe.efi"
+}
+
+resource "kea_clientclass" "efi_x64" {
+  name = "efi-x64"
+
+  # Match by client architecture type instead of a test expression.
+  arch_hex       = ["0007", "0009"]
+  boot_file_name = "ipxe.efi"
+}

examples/resources/kea_subnet/main.tf

@@ -0,0 +1,24 @@
+resource "kea_subnet" "lab" {
+  name        = "lab"
+  cluster_ref = "primary"
+  subnet      = "10.0.0.0/24"
+
+  pools          = ["10.0.0.100-10.0.0.200"]
+  routers        = ["10.0.0.1"]
+  dns_servers    = ["10.0.0.53"]
+  domain_name    = "lab.unkin.net"
+  valid_lifetime = 3600
+
+  # PXE boot options
+  next_server    = "10.0.0.1"
+  boot_file_name = "pxelinux.0"
+  client_classes = ["pxeclients"]
+
+  option_data = [
+    {
+      name = "tftp-server-name"
+      code = 66
+      data = "10.0.0.1"
+    },
+  ]
+}