Initial commit: full Phases 1-6 implementation

Post-repair hardware validation pipeline for Proxmox cluster hosts.
Go orchestrator + in-image agent + mkosi live image + bundled dnsmasq
PXE + SQLite + HTMX/SSE UI + notify registry + janitor + full docs.

internal/pxe/ipxe_test.go

@@ -0,0 +1,61 @@
+package pxe
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestBuildScriptIncludesAllCmdlineParams(t *testing.T) {
+	s := BuildScript(IPXEParams{
+		OrchestratorURL: "http://10.0.0.5:8080",
+		LiveKernelURL:   "http://10.0.0.5:8080/live/vmlinuz",
+		LiveInitrdURL:   "http://10.0.0.5:8080/live/initrd.img",
+		RunID:           42,
+		MAC:             "aa:bb:cc:dd:ee:ff",
+		Token:           "deadbeefcafe",
+	})
+	if !strings.HasPrefix(s, "#!ipxe") {
+		t.Fatalf("expected #!ipxe header, got %q", s[:10])
+	}
+	for _, want := range []string{
+		"vetting.orchestrator=http://10.0.0.5:8080",
+		"vetting.run_id=42",
+		"vetting.mac=aa:bb:cc:dd:ee:ff",
+		"vetting.token=deadbeefcafe",
+		"kernel http://10.0.0.5:8080/live/vmlinuz",
+		"initrd http://10.0.0.5:8080/live/initrd.img",
+		"ip=dhcp",
+		"boot",
+	} {
+		if !strings.Contains(s, want) {
+			t.Errorf("script missing %q\n%s", want, s)
+		}
+	}
+}
+
+func TestBuildScriptOmitsCertFPRWhenEmpty(t *testing.T) {
+	s := BuildScript(IPXEParams{
+		OrchestratorURL: "http://x", LiveKernelURL: "http://x/k", LiveInitrdURL: "http://x/i",
+		RunID: 1, MAC: "aa:bb:cc:dd:ee:ff", Token: "t",
+	})
+	if strings.Contains(s, "vetting.cert_fpr") {
+		t.Fatalf("cert_fpr should be absent when empty:\n%s", s)
+	}
+}
+
+func TestNotRegisteredScriptMentionsMAC(t *testing.T) {
+	s := NotRegisteredScript("aa:bb:cc:dd:ee:ff")
+	if !strings.Contains(s, "aa:bb:cc:dd:ee:ff") {
+		t.Fatalf("not-registered script should echo the MAC: %s", s)
+	}
+	if !strings.HasPrefix(s, "#!ipxe") {
+		t.Fatalf("missing #!ipxe header: %s", s)
+	}
+}
+
+func TestBuildLiveURLs(t *testing.T) {
+	k, i := BuildLiveURLs("http://h:8080/")
+	if k != "http://h:8080/live/vmlinuz" || i != "http://h:8080/live/initrd.img" {
+		t.Fatalf("BuildLiveURLs: %s, %s", k, i)
+	}
+}