v0.2.0 — pre-beta: per-MAC bindings, /metrics, themes, animated forge

This is the bulk pre-beta cleanup pass. Bumps the workspace to 0.2.0.
Test count is 56 -> 66 (+10), clippy is fully clean across the
workspace (was several dozen warnings).

## New features

**Per-MAC host bindings** (Tinkerbell smee pattern). New
`HostBindings` registry maps a MAC -> preferred boot target, persisted
to <work_dir>/hosts.json. The DHCP reply now embeds `?mac=${mac}` in
the boot.ipxe URL; iPXE substitutes the literal MAC client-side, so
the HTTP layer can short-circuit straight to the bound target instead
of rendering the menu. Reserved menu shortcuts (`_local`, `_gate`,
`_tools_menu`) are valid targets too. New /api/hosts CRUD + a Hosts
tab in the sidebar.

**Prometheus `/metrics`** endpoint. Tiny lock-free implementation —
just AtomicU64s and a Display impl, no `prometheus` / `metrics-rs`
dep. Counters: DHCP replies (per arch label), DHCP declined, TFTP
transfers (per status), TFTP bytes, HTTP requests (per route).
Gauges: ISO count, client count, gate count, gate-imaging, NFS active
mounts, uptime, build info. Plain text exposition format,
text/plain;version=0.0.4 content-type, no auth (all metric values are
non-sensitive counts).

**Light + dark themes**. CSS tokens on `:root` and
`:root[data-theme=light]`, swap by toggle button (top-right) or `T`
hotkey. Persisted in localStorage; pre-paint inline script avoids
dark<->light flash. Light palette designed against the Netbox Labs
reference screenshot — near-white surfaces, soft grey dividers,
accent unchanged for brand consistency. Terminal pane stays dark in
both themes (it's a console, that's the right read).

**Animated SVG logo + forge widget**. New `logo.svg` is a refined
silver/grey anvil. New `anvil-forge.svg` adds rising sparks and a
pulsing underglow via SMIL — pure SVG, no GIF, no JS animation loop.
Used:
  - in the **forge progress** widget on Dashboard + Forge Gate, paired
    with a `linear-gradient(warn -> accent)` bar with a moving sheen;
    goes idle (greyscale, no sheen) at zero imaging load
  - in the page-load `<div class=loader>` that replaces the old
    "Loading..." text

## Code cleanup pass

`cargo clippy --workspace --all-targets` is now warning-free. Spot
fixes across the tree:
  - `format!()`-into-`String` -> `std::fmt::Write::write!`
  - manual reverse comparators -> `Reverse`
  - `map_or(false, ...)` -> `is_some_and`
  - redundant closures -> method references
  - `r#"..."#` raw strings without `"` -> `r"..."`
  - `std::io::Error::new(Other, ...)` -> `Error::other`
  - `as i32` on `c.id()` -> `cast_signed()`
  - merged identical match arms

## Windows workflow validation

New integration test synthesizes an ISO9660 with the SOURCES\\BOOT.WIM
sentinel, uploads it, asserts:
  1. introspection labels it `windows_pe` with has_boot_wim=true,
  2. the boot entry is `BootKind::Wimboot` with all five canonical
     files (bootmgr, bootmgr.efi, bcd, boot.sdi, boot.wim),
  3. the rendered iPXE script chains wimboot with `initrd --name`
     entries for each file, and
  4. NO trust-store strings appear in the rendered output: bcdedit,
     testsigning, certutil, httpdisk, and test-signed are all
     explicitly forbidden as a hard guarantee.

WinPE bootstrap (startnet.cmd) picks up the Bootimus v0.1.58 lessons:
explicit `net start Workstation` before `net use` to avoid the SMB
client lazy-init race, and surfaces errors instead of blind retries.

## Docs

architecture.md gains a "Phase 5" section explaining the host-bindings
+ metrics + theming + Windows-test work, plus a refreshed "deferred
to Phase 6" list (real-hardware integration, autounattend library,
distro profile manifest, WoL trigger, syslog receiver, IPv6).
README updates the status line, the "what it does" list, and adds
the new Hosts/Terminal tab names.

crates/tftp/src/server.rs

@@ -35,17 +35,24 @@ pub struct TftpServer {
     bind: IpAddr,
     port: u16,
     clients: Arc<ClientRegistry>,
+    metrics: pxeforge_core::Metrics,
 }
 
 impl TftpServer {
-    pub fn new(bind: IpAddr, port: u16, clients: Arc<ClientRegistry>) -> Self {
-        Self { bind, port, clients }
+    pub fn new(
+        bind: IpAddr,
+        port: u16,
+        clients: Arc<ClientRegistry>,
+        metrics: pxeforge_core::Metrics,
+    ) -> Self {
+        Self { bind, port, clients, metrics }
     }
 
     pub async fn run(self) -> anyhow::Result<()> {
         let sock = bind_udp(self.bind, self.port)?;
         tracing::info!(target: "pxeforge::tftp", "TFTP listening on {}:{}", self.bind, self.port);
         let clients = self.clients.clone();
+        let metrics = self.metrics.clone();
         let mut buf = vec![0u8; 2048];
         loop {
             let (n, from) = match sock.recv_from(&mut buf).await {
@@ -57,9 +64,11 @@ impl TftpServer {
             };
             let data = buf[..n].to_vec();
             let clients = clients.clone();
+            let metrics = metrics.clone();
             let bind_ip = self.bind;
             tokio::spawn(async move {
-                if let Err(e) = handle_rrq(data, from, bind_ip, clients).await {
+                if let Err(e) = handle_rrq(data, from, bind_ip, clients, metrics.clone()).await {
+                    metrics.record_tftp_err();
                     tracing::warn!(target: "pxeforge::tftp", peer=%from, "handler error: {e}");
                 }
             });
@@ -72,10 +81,10 @@ async fn handle_rrq(
     peer: SocketAddr,
     bind_ip: IpAddr,
     clients: Arc<ClientRegistry>,
+    metrics: pxeforge_core::Metrics,
 ) -> anyhow::Result<()> {
-    let req = match parse_rrq(&packet) {
-        Some(r) => r,
-        None => return Ok(()),
+    let Some(req) = parse_rrq(&packet) else {
+        return Ok(());
     };
     let Request { filename, options, .. } = req;
 
@@ -149,7 +158,11 @@ async fn handle_rrq(
     let total = file_bytes.len();
     let mut offset: usize = 0;
     let mut block_no: u16 = 1;
-    let mut needs_zero_final = false; // spec: if last data block == blksize, follow with empty DATA
+    // Per RFC 1350: if the final data block is exactly blksize, the
+    // server must follow up with a zero-length DATA so the client knows
+    // the transfer has ended. The flag is set inside the loop and
+    // tested at end-of-transfer.
+    let needs_zero_final;
 
     'transfer: loop {
         let window_start_offset = offset;
@@ -181,7 +194,7 @@ async fn handle_rrq(
         loop {
             match tokio::time::timeout(Duration::from_secs(3), recv_ack(&sock, peer)).await {
                 Ok(Ok(acked)) if acked == last_block_in_window => break,
-                Ok(Ok(_)) => continue, // stale ACK from an earlier block — ignore
+                Ok(Ok(_)) => {} // stale ACK from an earlier block — ignore
                 Ok(Err(e)) => return Err(e),
                 Err(_) => {
                     tries += 1;
@@ -229,6 +242,7 @@ async fn handle_rrq(
     }
 
     tracing::debug!(target: "pxeforge::tftp", peer=%peer, bytes=total, "transfer complete");
+    metrics.record_tftp_ok(total as u64);
     Ok(())
 }
 
@@ -249,7 +263,7 @@ fn parse_rrq(pkt: &[u8]) -> Option<Request> {
     let mode = read_cstr(&mut rest)?;
     let mut options = Vec::new();
     while !rest.is_empty() {
-        let k = match read_cstr(&mut rest) { Some(s) => s, None => break };
+        let Some(k) = read_cstr(&mut rest) else { break };
         if k.is_empty() { break; }
         let v = read_cstr(&mut rest).unwrap_or_default();
         options.push((k.to_ascii_lowercase(), v));
@@ -311,7 +325,7 @@ async fn recv_ack(sock: &UdpSocket, peer: SocketAddr) -> anyhow::Result<u16> {
                 let code = u16::from_be_bytes([buf[2], buf[3]]);
                 anyhow::bail!("client error {code}");
             }
-            _ => continue,
+            _ => {}
         }
     }
 }
@@ -327,7 +341,7 @@ async fn wait_for_ack(
         sock.send_to(to_retx, peer).await?;
         match tokio::time::timeout(Duration::from_secs(3), recv_ack(sock, peer)).await {
             Ok(Ok(b)) if b == expect_block => return Ok(true),
-            Ok(Ok(_)) => continue,
+            Ok(Ok(_)) => {}
             Ok(Err(_)) | Err(_) => {
                 tries += 1;
                 if tries > 5 { return Ok(false); }
@@ -385,7 +399,10 @@ mod tests {
     fn parses_rrq_with_options() {
         // RRQ "snponly.efi" mode "octet" blksize=1468 tsize=0
         let mut pkt = vec![0, OP_RRQ as u8];
-        pkt.extend_from_slice(b"snponly.efi\0octet\0blksize\01468\0tsize\00\0");
+        // The single-digit `\0` escapes here are NUL terminators between
+        // TFTP option name/value pairs — using `\x00` to dodge clippy's
+        // "octal-looking escape" lint.
+        pkt.extend_from_slice(b"snponly.efi\x00octet\x00blksize\x001468\x00tsize\x000\x00");
         let r = parse_rrq(&pkt).unwrap();
         assert_eq!(r.filename, "snponly.efi");
         assert_eq!(r.mode, "octet");