Add quick-register one-liner for target-host registration

Operator pastes `curl -fsSL $ORCH/register/quick.sh | sudo bash` on the
target host (pre-wipe). The script probes MAC + CPU/RAM/disks/NICs/GPUs,
emits an expected-spec YAML, and POSTs to a new LAN-trusted JSON
endpoint /api/v1/hosts. The register page shows the command prefilled
with the orchestrator URL; the manual form moves into a collapsible
"Register manually" disclosure.

internal/api/ui_handlers.go

@@ -1,12 +1,14 @@
 package api
 
 import (
+	"encoding/json"
 	"errors"
 	"log"
 	"net/http"
 	"regexp"
 	"strconv"
 	"strings"
+	"text/template"
 
 	"github.com/go-chi/chi/v5"
 	"gopkg.in/yaml.v3"
@@ -15,6 +17,7 @@ import (
 	"vetting/internal/model"
 	"vetting/internal/orchestrator"
 	"vetting/internal/store"
+	"vetting/internal/web"
 	"vetting/internal/web/templates"
 )
 
@@ -25,10 +28,32 @@ type UI struct {
 	EventHub  *events.Hub
 	Runner    *orchestrator.Runner
 	Tiles     *TileEnricher
+	PublicURL string // user-visible base URL baked into the quick-register one-liner
 }
 
 var macRe = regexp.MustCompile(`^[0-9a-f]{2}(:[0-9a-f]{2}){5}$`)
 
+// quickRegisterTmpl is parsed once at startup — a malformed template
+// should fail the binary at init, not on a visitor's first hit.
+var quickRegisterTmpl = template.Must(
+	template.ParseFS(web.Register, "register/quick.sh.tmpl"),
+)
+
+// baseURL returns the orchestrator URL to bake into generated artefacts
+// (the quick-register one-liner, its rendered script). Prefers the
+// operator-configured public URL; falls back to the request's own host
+// so a dev run on http://127.0.0.1:8080 still produces a working command.
+func (u *UI) baseURL(r *http.Request) string {
+	if u.PublicURL != "" {
+		return strings.TrimRight(u.PublicURL, "/")
+	}
+	scheme := "http"
+	if r.TLS != nil {
+		scheme = "https"
+	}
+	return scheme + "://" + r.Host
+}
+
 func (u *UI) Dashboard(w http.ResponseWriter, r *http.Request) {
 	hosts, err := u.Hosts.List(r.Context())
 	if err != nil {
@@ -92,7 +117,22 @@ func (u *UI) StartRun(w http.ResponseWriter, r *http.Request) {
 }
 
 func (u *UI) NewHostForm(w http.ResponseWriter, r *http.Request) {
-	_ = templates.Registration(templates.RegistrationForm{}).Render(r.Context(), w)
+	_ = templates.Registration(templates.RegistrationForm{
+		QuickRegisterURL: u.baseURL(r),
+	}).Render(r.Context(), w)
+}
+
+// QuickRegisterScript renders the bash one-liner an operator pastes on
+// the target host: hardware autodetect + POST to /api/v1/hosts. The
+// orchestrator URL is substituted in so the script is self-contained.
+func (u *UI) QuickRegisterScript(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Content-Type", "text/x-shellscript; charset=utf-8")
+	w.Header().Set("Cache-Control", "no-store")
+	if err := quickRegisterTmpl.Execute(w, struct{ OrchestratorURL string }{
+		OrchestratorURL: u.baseURL(r),
+	}); err != nil {
+		log.Printf("quick-register script render: %v", err)
+	}
 }
 
 func (u *UI) CreateHost(w http.ResponseWriter, r *http.Request) {
@@ -107,6 +147,7 @@ func (u *UI) CreateHost(w http.ResponseWriter, r *http.Request) {
 		WoLPort:          r.PostForm.Get("wol_port"),
 		ExpectedSpecYAML: r.PostForm.Get("expected_spec_yaml"),
 		Notes:            strings.TrimSpace(r.PostForm.Get("notes")),
+		QuickRegisterURL: u.baseURL(r),
 	}
 
 	if errMsg := validateHostForm(&form); errMsg != "" {
@@ -138,6 +179,73 @@ func (u *UI) CreateHost(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, "/", http.StatusSeeOther)
 }
 
+// quickRegisterPayload is the POST body accepted by /api/v1/hosts —
+// the shape the quick-register bash one-liner emits.
+type quickRegisterPayload struct {
+	Name             string `json:"name"`
+	MAC              string `json:"mac"`
+	WoLBroadcastIP   string `json:"wol_broadcast_ip"`
+	WoLPort          int    `json:"wol_port"`
+	ExpectedSpecYAML string `json:"expected_spec_yaml"`
+	Notes            string `json:"notes"`
+}
+
+// CreateHostJSON is the API counterpart to CreateHost. Accepts the same
+// fields as the form but in JSON, so a target host can POST its own
+// registration payload over curl from the quick-register one-liner.
+// Same validation as the form; no auth (LAN-only).
+func (u *UI) CreateHostJSON(w http.ResponseWriter, r *http.Request) {
+	var p quickRegisterPayload
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 256*1024)).Decode(&p); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "bad json: "+err.Error())
+		return
+	}
+	form := templates.RegistrationForm{
+		Name:             strings.TrimSpace(p.Name),
+		MAC:              strings.ToLower(strings.TrimSpace(p.MAC)),
+		WoLBroadcastIP:   strings.TrimSpace(p.WoLBroadcastIP),
+		ExpectedSpecYAML: p.ExpectedSpecYAML,
+		Notes:            strings.TrimSpace(p.Notes),
+	}
+	if p.WoLPort > 0 {
+		form.WoLPort = strconv.Itoa(p.WoLPort)
+	}
+	if errMsg := validateHostForm(&form); errMsg != "" {
+		writeJSONError(w, http.StatusBadRequest, errMsg)
+		return
+	}
+	wolPort := p.WoLPort
+	if wolPort == 0 {
+		wolPort = 9
+	}
+	id, err := u.Hosts.Create(r.Context(), model.Host{
+		Name:             form.Name,
+		MAC:              form.MAC,
+		WoLBroadcastIP:   form.WoLBroadcastIP,
+		WoLPort:          wolPort,
+		ExpectedSpecYAML: form.ExpectedSpecYAML,
+		Notes:            form.Notes,
+	})
+	if err != nil {
+		writeJSONError(w, http.StatusConflict, friendlyDBError(err))
+		return
+	}
+	log.Printf("api: registered host %d (%s, %s)", id, form.Name, form.MAC)
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusCreated)
+	_ = json.NewEncoder(w).Encode(map[string]any{
+		"id":   id,
+		"name": form.Name,
+		"mac":  form.MAC,
+	})
+}
+
+func writeJSONError(w http.ResponseWriter, status int, msg string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(map[string]string{"error": msg})
+}
+
 // OverrideWipeStorage is the operator's explicit "yes, wipe the disk
 // even though we found filesystem signatures" button. Only meaningful
 // when the latest run is FailedHolding with failed_stage=Storage — the