v0.2.0 — pre-beta: per-MAC bindings, /metrics, themes, animated forge

This is the bulk pre-beta cleanup pass. Bumps the workspace to 0.2.0.
Test count is 56 -> 66 (+10), clippy is fully clean across the
workspace (was several dozen warnings).

## New features

**Per-MAC host bindings** (Tinkerbell smee pattern). New
`HostBindings` registry maps a MAC -> preferred boot target, persisted
to <work_dir>/hosts.json. The DHCP reply now embeds `?mac=${mac}` in
the boot.ipxe URL; iPXE substitutes the literal MAC client-side, so
the HTTP layer can short-circuit straight to the bound target instead
of rendering the menu. Reserved menu shortcuts (`_local`, `_gate`,
`_tools_menu`) are valid targets too. New /api/hosts CRUD + a Hosts
tab in the sidebar.

**Prometheus `/metrics`** endpoint. Tiny lock-free implementation —
just AtomicU64s and a Display impl, no `prometheus` / `metrics-rs`
dep. Counters: DHCP replies (per arch label), DHCP declined, TFTP
transfers (per status), TFTP bytes, HTTP requests (per route).
Gauges: ISO count, client count, gate count, gate-imaging, NFS active
mounts, uptime, build info. Plain text exposition format,
text/plain;version=0.0.4 content-type, no auth (all metric values are
non-sensitive counts).

**Light + dark themes**. CSS tokens on `:root` and
`:root[data-theme=light]`, swap by toggle button (top-right) or `T`
hotkey. Persisted in localStorage; pre-paint inline script avoids
dark<->light flash. Light palette designed against the Netbox Labs
reference screenshot — near-white surfaces, soft grey dividers,
accent unchanged for brand consistency. Terminal pane stays dark in
both themes (it's a console, that's the right read).

**Animated SVG logo + forge widget**. New `logo.svg` is a refined
silver/grey anvil. New `anvil-forge.svg` adds rising sparks and a
pulsing underglow via SMIL — pure SVG, no GIF, no JS animation loop.
Used:
  - in the **forge progress** widget on Dashboard + Forge Gate, paired
    with a `linear-gradient(warn -> accent)` bar with a moving sheen;
    goes idle (greyscale, no sheen) at zero imaging load
  - in the page-load `<div class=loader>` that replaces the old
    "Loading..." text

## Code cleanup pass

`cargo clippy --workspace --all-targets` is now warning-free. Spot
fixes across the tree:
  - `format!()`-into-`String` -> `std::fmt::Write::write!`
  - manual reverse comparators -> `Reverse`
  - `map_or(false, ...)` -> `is_some_and`
  - redundant closures -> method references
  - `r#"..."#` raw strings without `"` -> `r"..."`
  - `std::io::Error::new(Other, ...)` -> `Error::other`
  - `as i32` on `c.id()` -> `cast_signed()`
  - merged identical match arms

## Windows workflow validation

New integration test synthesizes an ISO9660 with the SOURCES\\BOOT.WIM
sentinel, uploads it, asserts:
  1. introspection labels it `windows_pe` with has_boot_wim=true,
  2. the boot entry is `BootKind::Wimboot` with all five canonical
     files (bootmgr, bootmgr.efi, bcd, boot.sdi, boot.wim),
  3. the rendered iPXE script chains wimboot with `initrd --name`
     entries for each file, and
  4. NO trust-store strings appear in the rendered output: bcdedit,
     testsigning, certutil, httpdisk, and test-signed are all
     explicitly forbidden as a hard guarantee.

WinPE bootstrap (startnet.cmd) picks up the Bootimus v0.1.58 lessons:
explicit `net start Workstation` before `net use` to avoid the SMB
client lazy-init race, and surfaces errors instead of blind retries.

## Docs

architecture.md gains a "Phase 5" section explaining the host-bindings
+ metrics + theming + Windows-test work, plus a refreshed "deferred
to Phase 6" list (real-hardware integration, autounattend library,
distro profile manifest, WoL trigger, syslog receiver, IPv6).
README updates the status line, the "what it does" list, and adds
the new Hosts/Terminal tab names.

docs/architecture.md

@@ -256,7 +256,70 @@ tab is one click from the brand bar.
 - Streaming uploads are already in place via axum multipart; the v0.1.62
   fix to "502 on big upload" doesn't apply.
 
-## What's deferred to Phase 5
+## Phase 5 — pre-beta hardening
+
+**Per-MAC host bindings** (`crates/core/src/host_bindings.rs`):
+- New `HostBindings` registry maps a MAC → preferred `BootEntry::id`
+  (or one of the reserved menu shortcuts `_local`, `_gate`,
+  `_tools_menu`).
+- Persisted to `<work_dir>/hosts.json`. Like `SettingsStore`, in-memory
+  is authoritative — disk corruption falls back to empty rather than
+  failing startup.
+- Inspired by Tinkerbell `smee`'s MAC-prepended URL pattern. The DHCP
+  reply now embeds `?mac=${mac}` in the boot.ipxe URL; iPXE substitutes
+  the literal MAC client-side, so the HTTP layer can short-circuit
+  past the menu when a binding exists.
+- `/api/hosts` GET / POST / DELETE drives the **Hosts** tab.
+
+**Prometheus metrics** (`crates/core/src/metrics.rs`):
+- Lock-free `AtomicU64`-backed counters + gauges. No `prometheus` /
+  `metrics-rs` dep — they bring a registry, runtime, and complexity
+  we don't need for a fixed set of metric families.
+- Counters: DHCP replies (per arch label), DHCP declined, TFTP
+  transfers (per status label), TFTP bytes, HTTP requests (per route
+  label).
+- Gauges: ISO count, client count, gate count, gate-imaging count,
+  NFS active mounts, uptime, build info.
+- Exposed as plain Prometheus text at `/metrics`.
+
+**Code cleanup pass**: clippy `--workspace --all-targets` is now
+warning-free. Replaced `format!()`-into-`String` with
+`std::fmt::Write::write!`, switched manual reverse comparators to
+`Reverse`, fixed `map_or(false, …)` → `is_some_and`, and a handful of
+other idiom fixes.
+
+**UI overhaul** for the v0.2.0 pre-beta milestone:
+- Light + dark themes via `:root[data-theme=light]` token swap.
+  Toggled by a top-right button or the `T` key. Persisted in
+  localStorage; pre-paint inline script avoids dark→light flash.
+- New SVG logos: a refined anvil (`logo.svg`) and a SMIL-animated
+  `anvil-forge.svg` (rising sparks + pulsing underglow). Pure SVG —
+  no GIFs, no CSS keyframes for the sparks.
+- "Forge progress" widget on the Dashboard and Forge Gate: animated
+  anvil paired with a `linear-gradient(warn → accent)` progress bar
+  with a moving sheen. Goes idle (greyscale, no sheen) at zero
+  imaging load.
+- Loader replaced "Loading…" text with the same anvil.
+- Sidebar gains a **Hosts** tab.
+
+**Windows boot validation**:
+- New integration test synthesizes an ISO9660 with the `SOURCES\BOOT.WIM`
+  sentinel, uploads it, and asserts:
+  1. introspection labels it `windows_pe` with `has_boot_wim=true`,
+  2. the boot entry is `BootKind::Wimboot` with all five canonical
+     files (`bootmgr`, `bootmgr.efi`, `bcd`, `boot.sdi`, `boot.wim`),
+  3. the rendered iPXE script chains wimboot with `initrd --name`
+     entries for each, and
+  4. **no** trust-store strings appear: `bcdedit`, `testsigning`,
+     `certutil`, `httpdisk`, `test-signed` are all explicitly
+     forbidden in the rendered output.
+- WinPE bootstrap (`startnet.cmd`) now picks up Bootimus v0.1.58
+  fixes: explicit `net start Workstation` before `net use`, surfaces
+  errors instead of blind retries.
+
+**Test count**: 66 → up from 56 in v0.1.0.
+
+## What's deferred to Phase 6
 
 - Full ISO9660 + Joliet + Rock Ridge parser (current lookup is plain ISO9660 — Debian ISOs with Rock Ridge extensions may miss some paths).
 - Real-hardware Windows boot validation (plumbing tested; no MS ISO pushed through the full pipeline yet).
@@ -268,3 +331,14 @@ tab is one click from the brand bar.
 - Pure-Rust SMB server (replace smbd) — slim image, no Samba.
 - Auto-install / autounattend file library (Bootimus v0.1.58 pattern).
 - Per-client / per-group menus (Bootimus v0.1.16 pattern).
+- Real-hardware integration: at minimum a Linux ISO booted on a real
+  BIOS box, a Windows ISO booted via wimboot on a real UEFI box, and a
+  Pi 4 booting from an NFS-mounted Raspberry Pi OS ISO.
+- Distro profile manifest (Bootimus v0.1.27 pattern) — currently
+  introspection logic is hard-coded; could become data-driven so an
+  operator can add a new distro profile from the UI without rebuilding.
+- Wake-on-LAN trigger (Bootimus v0.1.16 pattern) — power-on a host then
+  imaging starts unattended via a per-MAC binding.
+- Syslog receiver (smee feature) — capture client-side install syslog
+  for diagnostic visibility.
+- IPv6 PXE / DHCPv6 — currently IPv4 only.