Initial commit: full Phases 1-6 implementation

Post-repair hardware validation pipeline for Proxmox cluster hosts.
Go orchestrator + in-image agent + mkosi live image + bundled dnsmasq
PXE + SQLite + HTMX/SSE UI + notify registry + janitor + full docs.

internal/web/templates/dashboard.templ

@@ -0,0 +1,36 @@
+package templates
+
+import "vetting/internal/model"
+
+// TileData pairs a host with its latest run and the derived fields the
+// tile needs to render: spec-diff count (server-side diff result) and
+// the on-disk path to the hold-key artifact when the run is holding.
+type TileData struct {
+	Host             model.Host
+	Latest           *model.Run
+	SpecDiffCritical int
+	HoldKeyPath      string
+}
+
+templ Dashboard(tiles []TileData) {
+	@Layout("Dashboard") {
+		<section class="dashboard">
+			<div class="dashboard-header">
+				<h1>Registered hosts</h1>
+				<a class="button" href="/hosts/new">Register host</a>
+			</div>
+			if len(tiles) == 0 {
+				<div class="empty">
+					<p>No hosts registered yet.</p>
+					<a class="button" href="/hosts/new">Register your first host</a>
+				</div>
+			} else {
+				<div class="tile-grid" hx-ext="sse" sse-connect="/events">
+					for _, t := range tiles {
+						@HostTile(t)
+					}
+				</div>
+			}
+		</section>
+	}
+}