Initial commit: full Phases 1-6 implementation

Post-repair hardware validation pipeline for Proxmox cluster hosts.
Go orchestrator + in-image agent + mkosi live image + bundled dnsmasq
PXE + SQLite + HTMX/SSE UI + notify registry + janitor + full docs.

internal/orchestrator/tokens_test.go

@@ -0,0 +1,38 @@
+package orchestrator
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestIssueRunTokenRoundTrip(t *testing.T) {
+	plain, hash, err := IssueRunToken()
+	if err != nil {
+		t.Fatalf("IssueRunToken: %v", err)
+	}
+	if len(plain) != 64 {
+		t.Fatalf("plaintext should be 64 hex chars, got %d", len(plain))
+	}
+	if len(hash) != 64 {
+		t.Fatalf("hash should be 64 hex chars, got %d", len(hash))
+	}
+	if HashRunToken(plain) != hash {
+		t.Fatalf("HashRunToken(plain) != hash")
+	}
+	// Ensure high entropy: two consecutive issues differ.
+	plain2, _, _ := IssueRunToken()
+	if plain == plain2 {
+		t.Fatalf("expected distinct tokens on consecutive calls")
+	}
+}
+
+func TestHashRunTokenDeterministic(t *testing.T) {
+	h1 := HashRunToken("abc")
+	h2 := HashRunToken("abc")
+	if h1 != h2 {
+		t.Fatalf("hash not deterministic")
+	}
+	if strings.EqualFold(h1, HashRunToken("abd")) {
+		t.Fatalf("hash should differ for distinct inputs")
+	}
+}