Initial commit: full Phases 1-6 implementation

Post-repair hardware validation pipeline for Proxmox cluster hosts.
Go orchestrator + in-image agent + mkosi live image + bundled dnsmasq
PXE + SQLite + HTMX/SSE UI + notify registry + janitor + full docs.

Makefile

@@ -0,0 +1,79 @@
+.DEFAULT_GOAL := help
+UNAME_S := $(shell uname -s 2>/dev/null || echo Windows)
+GOOS_LINUX := GOOS=linux GOARCH=amd64
+GIT_SHA := $(shell git rev-parse --short HEAD 2>/dev/null || echo dev)
+LDFLAGS := -s -w -X vetting/internal/version.GitSHA=$(GIT_SHA)
+
+.PHONY: help
+help: ## Show targets
+	@awk 'BEGIN {FS = ":.*##"} /^[a-zA-Z_-]+:.*##/ {printf "  %-20s %s\n", $$1, $$2}' $(MAKEFILE_LIST)
+
+.PHONY: templ
+templ: ## Generate templ .go files
+	templ generate
+
+.PHONY: orchestrator
+orchestrator: templ ## Build orchestrator for host OS
+	go build -ldflags="$(LDFLAGS)" -o bin/vetting$(if $(filter Windows%,$(UNAME_S)),.exe,) ./cmd/vetting
+
+.PHONY: orchestrator-linux
+orchestrator-linux: templ ## Cross-build orchestrator for linux-amd64
+	$(GOOS_LINUX) go build -ldflags="$(LDFLAGS)" -o bin/vetting-linux-amd64 ./cmd/vetting
+
+.PHONY: agent
+agent: ## Build agent for host OS (handy for unit testing only — real agent runs in the live image)
+	go build -ldflags="$(LDFLAGS)" -o bin/vetting-agent$(if $(filter Windows%,$(UNAME_S)),.exe,) ./cmd/vetting-agent
+
+.PHONY: agent-linux
+agent-linux: ## Cross-build agent for linux-amd64 (consumed by live-image build)
+	$(GOOS_LINUX) go build -ldflags="$(LDFLAGS)" -o bin/vetting-agent.linux-amd64 ./cmd/vetting-agent
+
+.PHONY: gen-admin-password
+gen-admin-password: ## Build the bcrypt password generator
+	go build -o bin/gen-admin-password$(if $(filter Windows%,$(UNAME_S)),.exe,) ./tools/gen-admin-password
+
+.PHONY: tidy
+tidy: ## go mod tidy
+	go mod tidy
+
+.PHONY: fmt
+fmt: ## go fmt
+	go fmt ./...
+
+.PHONY: vet
+vet: ## go vet
+	go vet ./...
+
+.PHONY: test
+test: templ ## Run tests
+	go test ./...
+
+.PHONY: test-race
+test-race: templ ## Run tests with the race detector
+	go test -race -count=1 ./...
+
+.PHONY: e2e
+e2e: ## Run the QEMU PXE E2E test (Linux, root, live image required)
+	sudo go test -tags=e2e -v ./test/e2e/...
+
+.PHONY: live-image
+live-image: agent-linux ## Build reproducible live image (requires Linux/WSL + mkosi)
+ifneq ($(findstring Windows,$(UNAME_S))$(findstring MINGW,$(UNAME_S))$(findstring MSYS,$(UNAME_S)),)
+	@echo "ERROR: live-image must be built under Linux (use WSL: wsl make live-image)." && exit 1
+endif
+	$(MAKE) -C live-image all
+
+.PHONY: all
+all: orchestrator agent gen-admin-password ## Build everything buildable on host OS
+
+.PHONY: run
+run: orchestrator ## Build and run orchestrator with example config
+	./bin/vetting$(if $(filter Windows%,$(UNAME_S)),.exe,) --config deploy/vetting.example.yaml
+
+.PHONY: install
+install: orchestrator-linux ## Run deploy/install.sh (must be run on the target LXC as root)
+	sudo ./deploy/install.sh --binary ./bin/vetting-linux-amd64
+
+.PHONY: clean
+clean: ## Remove build artifacts
+	rm -rf bin out dist tmp