v0.2.0 — pre-beta: per-MAC bindings, /metrics, themes, animated forge

This is the bulk pre-beta cleanup pass. Bumps the workspace to 0.2.0.
Test count is 56 -> 66 (+10), clippy is fully clean across the
workspace (was several dozen warnings).

## New features

**Per-MAC host bindings** (Tinkerbell smee pattern). New
`HostBindings` registry maps a MAC -> preferred boot target, persisted
to <work_dir>/hosts.json. The DHCP reply now embeds `?mac=${mac}` in
the boot.ipxe URL; iPXE substitutes the literal MAC client-side, so
the HTTP layer can short-circuit straight to the bound target instead
of rendering the menu. Reserved menu shortcuts (`_local`, `_gate`,
`_tools_menu`) are valid targets too. New /api/hosts CRUD + a Hosts
tab in the sidebar.

**Prometheus `/metrics`** endpoint. Tiny lock-free implementation —
just AtomicU64s and a Display impl, no `prometheus` / `metrics-rs`
dep. Counters: DHCP replies (per arch label), DHCP declined, TFTP
transfers (per status), TFTP bytes, HTTP requests (per route).
Gauges: ISO count, client count, gate count, gate-imaging, NFS active
mounts, uptime, build info. Plain text exposition format,
text/plain;version=0.0.4 content-type, no auth (all metric values are
non-sensitive counts).

**Light + dark themes**. CSS tokens on `:root` and
`:root[data-theme=light]`, swap by toggle button (top-right) or `T`
hotkey. Persisted in localStorage; pre-paint inline script avoids
dark<->light flash. Light palette designed against the Netbox Labs
reference screenshot — near-white surfaces, soft grey dividers,
accent unchanged for brand consistency. Terminal pane stays dark in
both themes (it's a console, that's the right read).

**Animated SVG logo + forge widget**. New `logo.svg` is a refined
silver/grey anvil. New `anvil-forge.svg` adds rising sparks and a
pulsing underglow via SMIL — pure SVG, no GIF, no JS animation loop.
Used:
  - in the **forge progress** widget on Dashboard + Forge Gate, paired
    with a `linear-gradient(warn -> accent)` bar with a moving sheen;
    goes idle (greyscale, no sheen) at zero imaging load
  - in the page-load `<div class=loader>` that replaces the old
    "Loading..." text

## Code cleanup pass

`cargo clippy --workspace --all-targets` is now warning-free. Spot
fixes across the tree:
  - `format!()`-into-`String` -> `std::fmt::Write::write!`
  - manual reverse comparators -> `Reverse`
  - `map_or(false, ...)` -> `is_some_and`
  - redundant closures -> method references
  - `r#"..."#` raw strings without `"` -> `r"..."`
  - `std::io::Error::new(Other, ...)` -> `Error::other`
  - `as i32` on `c.id()` -> `cast_signed()`
  - merged identical match arms

## Windows workflow validation

New integration test synthesizes an ISO9660 with the SOURCES\\BOOT.WIM
sentinel, uploads it, asserts:
  1. introspection labels it `windows_pe` with has_boot_wim=true,
  2. the boot entry is `BootKind::Wimboot` with all five canonical
     files (bootmgr, bootmgr.efi, bcd, boot.sdi, boot.wim),
  3. the rendered iPXE script chains wimboot with `initrd --name`
     entries for each file, and
  4. NO trust-store strings appear in the rendered output: bcdedit,
     testsigning, certutil, httpdisk, and test-signed are all
     explicitly forbidden as a hard guarantee.

WinPE bootstrap (startnet.cmd) picks up the Bootimus v0.1.58 lessons:
explicit `net start Workstation` before `net use` to avoid the SMB
client lazy-init race, and surfaces errors instead of blind retries.

## Docs

architecture.md gains a "Phase 5" section explaining the host-bindings
+ metrics + theming + Windows-test work, plus a refreshed "deferred
to Phase 6" list (real-hardware integration, autounattend library,
distro profile manifest, WoL trigger, syslog receiver, IPv6).
README updates the status line, the "what it does" list, and adds
the new Hosts/Terminal tab names.

crates/http-api/src/app.rs

@@ -45,6 +45,7 @@ pub fn build_router(state: AppState) -> Router {
         .route("/assets/app.js", get(ui_js))
         .route("/assets/app.css", get(ui_css))
         .route("/assets/logo.svg", get(ui_logo))
+        .route("/assets/anvil-forge.svg", get(ui_anvil_forge))
         // iPXE script endpoints.
         .route("/boot.ipxe", get(boot_top_menu))
         .route("/boot/:filename", get(boot_sub))
@@ -80,6 +81,14 @@ pub fn build_router(state: AppState) -> Router {
         .route("/api/log/clear", post(log_stream::clear))
         // Phase 4: operator terminal commands (whitelisted).
         .route("/api/terminal", post(terminal::run_command))
+        // Phase 5: per-MAC host bindings (Tinkerbell-style). Operator
+        // pins a MAC to a boot entry; /boot.ipxe?mac=... chains directly.
+        .route("/api/hosts", get(api_hosts_list).post(api_hosts_upsert))
+        .route("/api/hosts/:mac", delete(api_hosts_remove))
+        // Phase 5: Prometheus scrape endpoint. Plain text exposition
+        // format. No auth — the metrics surface is intentionally
+        // boring (counts, no payloads).
+        .route("/metrics", get(api_metrics))
         .layer(TraceLayer::new_for_http())
         // 16 GiB upload cap — ISOs are big; chunks stream so this isn't memory use.
         .layer(DefaultBodyLimit::max(16 * 1024 * 1024 * 1024))
@@ -115,6 +124,13 @@ async fn ui_logo() -> Response {
     ).into_response()
 }
 
+async fn ui_anvil_forge() -> Response {
+    (
+        [(header::CONTENT_TYPE, HeaderValue::from_static("image/svg+xml"))],
+        pxeforge_webui::anvil_forge_svg(),
+    ).into_response()
+}
+
 // ─── iPXE scripts ──────────────────────────────────────────────────────────
 
 fn text_plain(body: String) -> Response {
@@ -122,10 +138,51 @@ fn text_plain(body: String) -> Response {
         .into_response()
 }
 
-async fn boot_top_menu(State(state): State<AppState>) -> Response {
+/// Top-level boot script. Honors per-MAC host bindings: if the
+/// requesting client carries a `?mac=...` query param (iPXE's `${mac}`
+/// substitution) and that MAC has a binding, we short-circuit straight
+/// to the bound target instead of rendering the menu.
+async fn boot_top_menu(
+    State(state): State<AppState>,
+    Query(p): Query<BootMenuParams>,
+) -> Response {
+    state.metrics.record_http(pxeforge_core::HttpRoute::BootScript);
     let isos = state.iso_store.list();
     let settings = state.settings.snapshot();
-    text_plain(render_menu(&isos, &settings, &state.public_base_url))
+    let base = &state.public_base_url;
+
+    // Per-MAC override: if the client identified itself and we have a
+    // binding, chain directly. The chain target falls back to the menu
+    // on failure so a stale / misconfigured binding can't lock a client
+    // out — it just shows the menu.
+    if let Some(mac) = p.mac.as_deref() {
+        if let Some(binding) = state.hosts.lookup(mac) {
+            tracing::info!(
+                target: "pxeforge::http",
+                mac = %binding.mac, target = %binding.target,
+                "host binding applied"
+            );
+            let target = binding.target;
+            // Reserved menu shortcuts are emitted as `_xxx`; per-entry
+            // boot scripts are at `/boot/<id>.ipxe`. Both share the same
+            // `/boot/<name>` route, so the URL is identical.
+            return text_plain(format!(
+                "#!ipxe\n\
+                 echo PXEForge: per-MAC binding -> {target}\n\
+                 chain {base}/boot/{target}.ipxe || chain {base}/boot.ipxe\n"
+            ));
+        }
+    }
+
+    text_plain(render_menu(&isos, &settings, base))
+}
+
+#[derive(Debug, Deserialize)]
+struct BootMenuParams {
+    /// Client MAC, supplied by iPXE via `${mac}` variable in
+    /// `chain ${prefix}/boot.ipxe?mac=${mac}`. Optional — if absent we
+    /// fall back to the menu unconditionally.
+    mac: Option<String>,
 }
 
 async fn boot_sub(
@@ -204,7 +261,7 @@ async fn iso_file(
         return (StatusCode::NOT_FOUND, "no such iso").into_response();
     };
     let p = iso_path.clone();
-    let in_path = format!("/{}", path);
+    let in_path = format!("/{path}");
     let loc = tokio::task::spawn_blocking(move || iso_fs::lookup(&p, &in_path))
         .await.ok().flatten();
     let Some(loc) = loc else {
@@ -362,18 +419,27 @@ async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
     let nfs = state.nfs.list();
     let nfs_active = nfs.iter().filter(|m| m.mounted).count();
     let isos = state.iso_store.list();
+    let clients = state.clients.list();
     let gates = state.gates.list();
     // Phase 4: dashboard tracks "imaging" as gates with an assignment
     // already issued — they're the ones actively chaining a boot script.
     let imaging = gates.iter().filter(|g| g.assigned_target.is_some()).count();
     let waiting = gates.len() - imaging;
+    // Side-effect: push gauge values out to the Prometheus surface.
+    // Doing it here (in the most-frequently-polled endpoint) keeps the
+    // gauges fresh without a dedicated scrape-time hook.
+    state.metrics.set_iso_count(isos.len() as u64);
+    state.metrics.set_client_count(clients.len() as u64);
+    state.metrics.set_gate_counts(gates.len() as u64, imaging as u64);
+    state.metrics.set_nfs_active(nfs_active as u64);
+    state.metrics.record_http(pxeforge_core::HttpRoute::Api);
     let now = time::OffsetDateTime::now_utc();
     let uptime_secs = (now - state.started_at).whole_seconds().max(0);
     Json(json!({
         "version": env!("CARGO_PKG_VERSION"),
         "public_base_url": state.public_base_url,
         "iso_count": isos.len(),
-        "client_count": state.clients.list().len(),
+        "client_count": clients.len(),
         "gate_count": gates.len(),
         "imaging_count": imaging,
         "waiting_count": waiting,
@@ -382,6 +448,7 @@ async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
         "smb": smb,
         "nfs_count": nfs.len(),
         "nfs_active": nfs_active,
+        "host_bindings": state.hosts.len(),
         "uptime_secs": uptime_secs,
         "started_at": state.started_at,
         "nic_name": state.nic_name,
@@ -650,6 +717,94 @@ async fn api_network_put(
     StatusCode::NO_CONTENT
 }
 
+// ─── Per-MAC host bindings ────────────────────────────────────────────────
+
+async fn api_hosts_list(State(state): State<AppState>) -> Json<serde_json::Value> {
+    Json(json!({ "hosts": state.hosts.list() }))
+}
+
+#[derive(Debug, Deserialize)]
+struct HostsUpsertBody {
+    mac: String,
+    target: String,
+    #[serde(default)]
+    label: String,
+}
+
+async fn api_hosts_upsert(
+    State(state): State<AppState>,
+    Json(body): Json<HostsUpsertBody>,
+) -> Response {
+    let mac = body.mac.trim();
+    if mac.is_empty() {
+        return (StatusCode::BAD_REQUEST, "mac is required").into_response();
+    }
+    // Sanity-check the target if the operator supplied a real boot
+    // entry id (anything starting with `_` is a reserved menu shortcut
+    // and exists by definition).
+    let target = body.target.trim();
+    if !target.starts_with('_')
+        && !state
+            .iso_store
+            .list()
+            .into_iter()
+            .any(|i| i.boot_entries.iter().any(|e| e.id == target))
+    {
+        return (
+            StatusCode::BAD_REQUEST,
+            format!("unknown boot entry: {target}"),
+        )
+            .into_response();
+    }
+    let binding = state.hosts.upsert(mac, target, body.label.trim());
+    (StatusCode::CREATED, Json(binding)).into_response()
+}
+
+async fn api_hosts_remove(
+    State(state): State<AppState>,
+    AxumPath(mac): AxumPath<String>,
+) -> StatusCode {
+    if state.hosts.remove(&mac) {
+        StatusCode::NO_CONTENT
+    } else {
+        StatusCode::NOT_FOUND
+    }
+}
+
+// ─── Prometheus metrics ───────────────────────────────────────────────────
+
+async fn api_metrics(State(state): State<AppState>) -> Response {
+    // Refresh gauges from live state before rendering — keeps the
+    // scrape "honest" without making /api/status the only path that
+    // updates them.
+    state
+        .metrics
+        .set_iso_count(state.iso_store.list().len() as u64);
+    state
+        .metrics
+        .set_client_count(state.clients.list().len() as u64);
+    let gates = state.gates.list();
+    let imaging = gates.iter().filter(|g| g.assigned_target.is_some()).count();
+    state
+        .metrics
+        .set_gate_counts(gates.len() as u64, imaging as u64);
+    state
+        .metrics
+        .set_nfs_active(state.nfs.list().iter().filter(|m| m.mounted).count() as u64);
+
+    let now = time::OffsetDateTime::now_utc();
+    let uptime = (now - state.started_at).whole_seconds().max(0) as u64;
+    let body = state.metrics.render(env!("CARGO_PKG_VERSION"), uptime);
+    (
+        [(
+            header::CONTENT_TYPE,
+            HeaderValue::from_static("text/plain; version=0.0.4; charset=utf-8"),
+        )],
+        body,
+    )
+        .into_response()
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

crates/http-api/src/ipxe_script.rs

@@ -35,11 +35,11 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     let base = base_url.trim_end_matches('/');
     let timeout_ms = settings.boot_menu_timeout_secs.saturating_mul(1000);
     let default_item = match settings.timeout_action {
-        TimeoutAction::LocalHdd => "local",
         TimeoutAction::GatedDeployment => "gate",
         // Stay -> iPXE's `--timeout 0` is "no timeout". Pick any default
-        // label; the client waits for keypress.
-        TimeoutAction::Stay => "local",
+        // label; the client waits for keypress. We use the same label as
+        // LocalHdd to keep the menu's pre-highlight stable.
+        TimeoutAction::LocalHdd | TimeoutAction::Stay => "local",
     };
 
     let _ = writeln!(s, "#!ipxe");
@@ -135,7 +135,7 @@ pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) ->
 /// operator expectations from the original tool).
 fn fmt_size_mib(bytes: u64) -> String {
     let mib = bytes / (1024 * 1024);
-    format!("{} MB", mib)
+    format!("{mib} MB")
 }
 
 /// Assign `--key N <id>` hotkeys 1..9, then nothing for positions >=9.

crates/http-api/src/lib.rs

@@ -6,8 +6,8 @@
 //!   - `/ipxe/<file>`        bundled iPXE binaries (for UEFI HTTP boot)
 //!   - `/iso/<id>.iso`       raw ISO file (with Range support)
 //!   - `/iso/<id>/<path>`    files inside the ISO (for wimboot WIM fetches
-//!                           and Linux kernel/initrd, without having to
-//!                           re-extract on every request)
+//!     and Linux kernel/initrd, without having to
+//!     re-extract on every request)
 //!
 //! The `<id>/<path>` handler uses a read-only ISO9660 shim (see `iso_fs`)
 //! that lseeks into the ISO on disk — so we never keep extracted copies.

crates/http-api/src/state.rs

@@ -1,4 +1,4 @@
-use pxeforge_core::{ClientRegistry, GateQueue, LogBus, SettingsStore};
+use pxeforge_core::{ClientRegistry, GateQueue, HostBindings, LogBus, Metrics, SettingsStore};
 use pxeforge_iso_store::{IsoStore, NfsManager, SmbManager};
 use std::sync::Arc;
 use time::OffsetDateTime;
@@ -9,6 +9,13 @@ pub struct AppState {
     pub clients: Arc<ClientRegistry>,
     pub settings: Arc<SettingsStore>,
     pub gates: Arc<GateQueue>,
+    /// Per-MAC iPXE script overrides. When a client matching one of
+    /// these MACs requests `/boot.ipxe`, we chain straight to the
+    /// configured target instead of rendering the menu.
+    pub hosts: HostBindings,
+    /// Lock-free metrics counters surfaced at `/metrics` in Prometheus
+    /// text format. Cheap to clone (handles to atomics).
+    pub metrics: Metrics,
     /// Optional SMB manager. Present when the binary was given a writable
     /// `smb_dir` at startup; `None` in pure-Linux-only deployments where
     /// Windows support is not wired in. Settings toggle drives start/stop.

crates/http-api/src/terminal.rs

@@ -161,8 +161,8 @@ fn clients_text(s: &AppState) -> String {
     let mut out = String::new();
     let _ = writeln!(
         out,
-        "{:<19} {:<16} {:<8} {}",
-        "MAC", "IP", "EVENTS", "LAST SEEN"
+        "{:<19} {:<16} {:<8} LAST SEEN",
+        "MAC", "IP", "EVENTS"
     );
     for c in clients {
         let ip = c.last_ip.map_or_else(|| "-".into(), |i| i.to_string());
@@ -259,8 +259,8 @@ async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
             let mut out = String::new();
             let _ = writeln!(
                 out,
-                "{:<24} {:<6} {:<7} {:<6} {}",
-                "ID", "VER", "STATUS", "ISOS", "TARGET"
+                "{:<24} {:<6} {:<7} {:<6} TARGET",
+                "ID", "VER", "STATUS", "ISOS"
             );
             for m in mounts {
                 let status = if m.mounted { "ok" } else { "down" };