v0.4.69: PNG boot-menu background (iPXE built from source), NFS AUTH_SYS, FleetDM logo

Three things, headlined by the long-blocked graphical PXE menu.

## 1. Graphical PXE boot background — the iVentoy feature, finally

iVentoy paints a PNG background on the PXE screen using stock iPXE
built with CONSOLE_FRAMEBUFFER + IMAGE_PNG + CONSOLE_CMD; the public
iPXE binaries omit those, so `console --picture` is a no-op on them.
We now build our own iPXE from upstream with that thin config delta
(deploy/ipxe/local/{general,console}.h).

The 8-release blocker was cc1 segfaulting when an amd64 gcc ran under
QEMU emulation on the arm64 build host. Fix: a new `ipxe-build`
Dockerfile stage pinned to $BUILDPLATFORM (native arch — no emulation)
that cross-compiles x86_64 iPXE with CROSS_COMPILE=x86_64-linux-gnu-.
The compiler runs native and emits x86_64. Validated end-to-end:
png.o + fbcon.o + pixbuf.o all compile and link (confirmed via the
linked-ELF symbol table, not just strings), ~112s, no segfault. Host
tools needed libc6-dev (dropped by --no-install-recommends; without
it the native host compile falls through to iPXE's freestanding
headers and dies on bits/stdint.h — fixed).

Server side:
- pxe_logo.rs is now a full-screen background compositor: a dark field
  (matching the WebUI theme) with the operator's uploaded logo across
  the top, or — with no upload — a default OpenPXE rainbow disc drawn
  with pure pixel math (no font/SVG deps). Always 1024x768 (iPXE
  doesn't scale; this is the universal mode). WebP/JPEG/GIF/PNG in,
  PNG out (iPXE only eats PNG).
- /branding/pxe-logo always returns a PNG now (default when no logo,
  default when SVG) so the menu always has a background.
- render_menu uses `console --picture … --top 290 || console`: paints
  the background and reserves the logo band on PNG-capable binaries
  (x86_64 UEFI), cleanly falls back to text on the others. The ASCII
  wordmark is GONE.

Only x86_64 UEFI is built from source (host-arch-agnostic cross build);
BIOS/i386/arm64 keep upstream-fetched no-PNG binaries + text fallback.
Modern clients are overwhelmingly x86_64 UEFI.

## 2. NFS AUTH_SYS credential — fixes NFS3ERR_ACCES

v0.4.68's privileged-port fix got past MNT3ERR_ACCES (mount); operators
then hit NFS3ERR_ACCES on READDIR because nfs3_client defaults to
AUTH_NONE and virtually every server exports sec=sys. We now present an
AUTH_UNIX credential (uid 0 / gid 0): no_root_squash servers treat us
as root, root_squash servers map us to anon which reads any
world-readable ISO share. Kept fixed (no UI knob) to stay dead-simple.
Hint updated: a remaining NFS3ERR_ACCES is now a server-side
permission/squash issue, not IP/auth-flavor.

## 3. FleetDM-style full-width logo (top-left)

When a custom logo is uploaded the sidebar header drops the bundled
mark + "OpenPXE" wordmark and lets the logo span the header
(left-aligned, capped 200x50, contain). Rendered server-side via a
brand-class in index_html (has_custom_logo) so there's no flash of the
default. The bundled-default case is unchanged.

Tests: 164 passing. clippy -D warnings clean. iPXE build stage
validated in isolation before the full image build.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/http-api/src/app.rs

@@ -215,6 +215,7 @@ async fn index(State(state): State<AppState>) -> Response {
         &state.public_base_url,
         env!("CARGO_PKG_VERSION"),
         state.branding.logo_rev(),
+        state.branding.has_logo(),
     );
     (
         [
@@ -318,74 +319,75 @@ async fn ui_logo(State(state): State<AppState>) -> Response {
         .into_response()
 }
 
-/// v0.4.61: PXE menu logo composed for the iPXE `console --picture`
-/// call. The operator can upload any raster image (PNG / JPEG / WebP /
-/// GIF) of any aspect ratio; this handler decodes it, draws it
-/// centered-top onto a fixed 1024×768 canvas, and returns PNG bytes.
-/// That gives the same look as iVentoy regardless of what the operator
-/// uploaded — a portrait logo, a wide wordmark, a square monogram all
-/// land in the same place on the boot screen.
+/// PXE boot-menu background, composed for the iPXE `console --picture`
+/// call. Returns a full-screen 1024×768 PNG: a dark field with the
+/// operator's uploaded logo across the top, or — when no logo is set —
+/// a default OpenPXE mark on the same dark field. Either way the
+/// endpoint *always* returns a valid PNG so the menu's `console
+/// --picture` paints a real background instead of falling through to
+/// bare text (v0.4.69 — replaces the old ASCII wordmark).
 ///
-/// SVG uploads still 404 here — iPXE can't rasterize SVG, and rather
-/// than haul in `resvg` we ask the operator to provide a raster when
-/// they want a custom PXE-side logo. (The WebUI keeps using the SVG.)
+/// Any raster the operator uploads (PNG / JPEG / WebP / GIF) is decoded
+/// and transcoded to PNG here, since iPXE only consumes PNG. SVG
+/// uploads can't be rasterized without hauling in `resvg`, so an SVG
+/// brand mark falls back to the *default* background for the PXE screen
+/// (the WebUI still renders the SVG natively in the top-left).
 async fn ui_pxe_logo(State(state): State<AppState>) -> Response {
-    let Some(path) = state.branding.logo_path() else {
-        return (StatusCode::NOT_FOUND, "no custom logo configured").into_response();
+    // Resolve the operator's raster upload, if any and if it's a format
+    // iPXE/our compositor can consume. SVG (or a missing/unreadable
+    // file) yields `None`, which composes the default background.
+    let raster: Option<Vec<u8>> = match (state.branding.logo_path(), state.branding.logo_mime()) {
+        (Some(path), Some(mime)) if mime != "image/svg+xml" => {
+            tokio::fs::read(&path).await.ok()
+        }
+        _ => None,
     };
-    let Some(mime) = state.branding.logo_mime() else {
-        return (StatusCode::NOT_FOUND, "no mime recorded").into_response();
-    };
-    if mime == "image/svg+xml" {
-        return (
-            StatusCode::NOT_FOUND,
-            "operator-uploaded logo is SVG; PXE menu requires a raster (PNG / JPEG / WebP / GIF)",
-        )
-            .into_response();
-    }
-    let bytes = match tokio::fs::read(&path).await {
-        Ok(b) => b,
+
+    let composed = match tokio::task::spawn_blocking(move || {
+        openpxe_iso_store::pxe_logo::compose_pxe_background(raster.as_deref())
+    })
+    .await
+    {
+        Ok(Ok(png)) => png,
+        Ok(Err(e)) => {
+            // A decode failure on the operator's upload shouldn't blank
+            // the boot screen — fall back to the default background.
+            tracing::warn!(
+                target: "openpxe::http::branding",
+                error = %e, "PXE background compose failed on upload; using default"
+            );
+            match tokio::task::spawn_blocking(|| {
+                openpxe_iso_store::pxe_logo::compose_pxe_background(None)
+            })
+            .await
+            {
+                Ok(Ok(png)) => png,
+                _ => {
+                    return (
+                        StatusCode::INTERNAL_SERVER_ERROR,
+                        "failed to compose PXE background",
+                    )
+                        .into_response();
+                }
+            }
+        }
         Err(e) => {
             return (
-                StatusCode::NOT_FOUND,
-                format!("custom logo unreadable: {e}"),
+                StatusCode::INTERNAL_SERVER_ERROR,
+                format!("pxe-background task failed: {e}"),
             )
                 .into_response();
         }
     };
-    // Compose to a fixed 1024×768 PNG so the PXE menu paints the logo
-    // centered-top regardless of the operator's source dimensions. The
-    // `image` crate is pure-Rust + sync; offload to a blocking task
-    // because Lanczos resampling on a 4K source can take tens of
-    // milliseconds and we don't want to block the executor.
-    let composed =
-        match tokio::task::spawn_blocking(move || openpxe_iso_store::pxe_logo::compose_pxe_logo(&bytes))
-            .await
-        {
-            Ok(Ok(png)) => png,
-            Ok(Err(e)) => {
-                tracing::warn!(
-                    target: "openpxe::http::branding",
-                    error = %e, "failed to compose PXE logo PNG"
-                );
-                return (
-                    StatusCode::INTERNAL_SERVER_ERROR,
-                    format!("failed to compose PXE logo: {e}"),
-                )
-                    .into_response();
-            }
-            Err(e) => {
-                return (
-                    StatusCode::INTERNAL_SERVER_ERROR,
-                    format!("pxe-logo task failed: {e}"),
-                )
-                    .into_response();
-            }
-        };
     (
         [
             (header::CONTENT_TYPE, HeaderValue::from_static("image/png")),
-            (header::CACHE_CONTROL, ASSET_CACHE_CONTROL),
+            // No-cache so a freshly uploaded logo paints on the next
+            // boot without a stale composite lingering.
+            (
+                header::CACHE_CONTROL,
+                HeaderValue::from_static("no-cache, max-age=0"),
+            ),
         ],
         composed,
     )