Initial implementation: host lifecycle + PXE + admin dashboard

Go service for Proxmox homelab cluster provisioning. Handles PXE boot,
Proxmox autoinstall (answer file generation), cluster join via SSH,
and Infrastructure API registration.

- Host state machine (registered → pxe_ready → installing → ready)
- dnsmasq supervisor with MAC-based allowlist
- iPXE script and Proxmox answer file generation
- First-boot phone-home → cluster join → infra registration
- Operation locking with expiry (409 on conflict)
- SSE event hub for real-time dashboard updates
- Admin dashboard (host grid, detail, registration form)
- Config-driven server types with hot-reload
- Docker deployment (multi-stage fat image)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/pxe/firstboot.go

@@ -0,0 +1,28 @@
+package pxe
+
+import (
+	"fmt"
+
+	"provisioning/internal/config"
+	"provisioning/internal/model"
+)
+
+func GenerateFirstBootScript(host *model.Host, serverType model.ServerType, cfg *config.Config) string {
+	return fmt.Sprintf(`#!/bin/bash
+set -euo pipefail
+
+PROVISIONING_URL="%s"
+HOST_ID="%d"
+NIC="%s"
+
+IP=$(ip -4 addr show dev "$NIC" | grep -oP '(?<=inet\s)\d+(\.\d+){3}')
+HWID=$(dmidecode -s system-uuid)
+
+curl -fsSL -X POST "${PROVISIONING_URL}/api/hosts/${HOST_ID}/phone-home" \
+  -H "Content-Type: application/json" \
+  -d "{\"ip\": \"${IP}\", \"hardware_id\": \"${HWID}\", \"hostname\": \"$(hostname)\"}"
+
+systemctl disable provisioning-firstboot.service
+rm -f /etc/systemd/system/provisioning-firstboot.service
+`, cfg.Server.PublicURL, host.ID, serverType.ManagementNIC)
+}