v0.2.0 — pre-beta: per-MAC bindings, /metrics, themes, animated forge

This is the bulk pre-beta cleanup pass. Bumps the workspace to 0.2.0.
Test count is 56 -> 66 (+10), clippy is fully clean across the
workspace (was several dozen warnings).

## New features

**Per-MAC host bindings** (Tinkerbell smee pattern). New
`HostBindings` registry maps a MAC -> preferred boot target, persisted
to <work_dir>/hosts.json. The DHCP reply now embeds `?mac=${mac}` in
the boot.ipxe URL; iPXE substitutes the literal MAC client-side, so
the HTTP layer can short-circuit straight to the bound target instead
of rendering the menu. Reserved menu shortcuts (`_local`, `_gate`,
`_tools_menu`) are valid targets too. New /api/hosts CRUD + a Hosts
tab in the sidebar.

**Prometheus `/metrics`** endpoint. Tiny lock-free implementation —
just AtomicU64s and a Display impl, no `prometheus` / `metrics-rs`
dep. Counters: DHCP replies (per arch label), DHCP declined, TFTP
transfers (per status), TFTP bytes, HTTP requests (per route).
Gauges: ISO count, client count, gate count, gate-imaging, NFS active
mounts, uptime, build info. Plain text exposition format,
text/plain;version=0.0.4 content-type, no auth (all metric values are
non-sensitive counts).

**Light + dark themes**. CSS tokens on `:root` and
`:root[data-theme=light]`, swap by toggle button (top-right) or `T`
hotkey. Persisted in localStorage; pre-paint inline script avoids
dark<->light flash. Light palette designed against the Netbox Labs
reference screenshot — near-white surfaces, soft grey dividers,
accent unchanged for brand consistency. Terminal pane stays dark in
both themes (it's a console, that's the right read).

**Animated SVG logo + forge widget**. New `logo.svg` is a refined
silver/grey anvil. New `anvil-forge.svg` adds rising sparks and a
pulsing underglow via SMIL — pure SVG, no GIF, no JS animation loop.
Used:
  - in the **forge progress** widget on Dashboard + Forge Gate, paired
    with a `linear-gradient(warn -> accent)` bar with a moving sheen;
    goes idle (greyscale, no sheen) at zero imaging load
  - in the page-load `<div class=loader>` that replaces the old
    "Loading..." text

## Code cleanup pass

`cargo clippy --workspace --all-targets` is now warning-free. Spot
fixes across the tree:
  - `format!()`-into-`String` -> `std::fmt::Write::write!`
  - manual reverse comparators -> `Reverse`
  - `map_or(false, ...)` -> `is_some_and`
  - redundant closures -> method references
  - `r#"..."#` raw strings without `"` -> `r"..."`
  - `std::io::Error::new(Other, ...)` -> `Error::other`
  - `as i32` on `c.id()` -> `cast_signed()`
  - merged identical match arms

## Windows workflow validation

New integration test synthesizes an ISO9660 with the SOURCES\\BOOT.WIM
sentinel, uploads it, asserts:
  1. introspection labels it `windows_pe` with has_boot_wim=true,
  2. the boot entry is `BootKind::Wimboot` with all five canonical
     files (bootmgr, bootmgr.efi, bcd, boot.sdi, boot.wim),
  3. the rendered iPXE script chains wimboot with `initrd --name`
     entries for each file, and
  4. NO trust-store strings appear in the rendered output: bcdedit,
     testsigning, certutil, httpdisk, and test-signed are all
     explicitly forbidden as a hard guarantee.

WinPE bootstrap (startnet.cmd) picks up the Bootimus v0.1.58 lessons:
explicit `net start Workstation` before `net use` to avoid the SMB
client lazy-init race, and surfaces errors instead of blind retries.

## Docs

architecture.md gains a "Phase 5" section explaining the host-bindings
+ metrics + theming + Windows-test work, plus a refreshed "deferred
to Phase 6" list (real-hardware integration, autounattend library,
distro profile manifest, WoL trigger, syslog receiver, IPv6).
README updates the status line, the "what it does" list, and adds
the new Hosts/Terminal tab names.

crates/webui/src/logo.svg

@@ -1,14 +1,32 @@
-<svg viewBox="0 0 96 64" fill="none" xmlns="http://www.w3.org/2000/svg">
+<svg viewBox="0 0 200 130" xmlns="http://www.w3.org/2000/svg" fill="none">
   <title>PXEForge</title>
-  <!-- Anvil body -->
-  <path d="M6 22 H82 L70 36 H46 V44 H58 V50 H30 V44 H42 V36 H22 Z" fill="#f0823a" stroke="#3a1f08" stroke-width="1.2"/>
-  <!-- Horn highlight -->
-  <path d="M6 22 L20 22 L14 28 L6 28 Z" fill="#ffb066"/>
-  <!-- Stand + base -->
-  <rect x="34" y="50" width="20" height="4" fill="#3a1f08"/>
-  <rect x="22" y="54" width="44" height="6" fill="#1c1107"/>
-  <!-- Subtle spark -->
-  <circle cx="86" cy="16" r="1.5" fill="#ffd79a"/>
-  <circle cx="90" cy="22" r="1" fill="#ffd79a"/>
-  <circle cx="82" cy="12" r="1" fill="#ffd79a"/>
+  <defs>
+    <linearGradient id="anvilBody" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0%" stop-color="#aab3c2"/>
+      <stop offset="55%" stop-color="#7d8696"/>
+      <stop offset="100%" stop-color="#525a6b"/>
+    </linearGradient>
+    <linearGradient id="anvilFace" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0%" stop-color="#cdd5e1"/>
+      <stop offset="100%" stop-color="#9aa3b3"/>
+    </linearGradient>
+    <linearGradient id="anvilBase" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0%" stop-color="#3b4252"/>
+      <stop offset="100%" stop-color="#252a36"/>
+    </linearGradient>
+  </defs>
+  <!-- Horn (left point) + face (top) -->
+  <path d="M14 36 L72 30 L162 30 L162 46 L72 46 Z"
+        fill="url(#anvilFace)" stroke="#1d2330" stroke-width="2.4" stroke-linejoin="round"/>
+  <!-- Body / waist -->
+  <path d="M70 46 L160 46 L142 70 L88 70 Z"
+        fill="url(#anvilBody)" stroke="#1d2330" stroke-width="2.4" stroke-linejoin="round"/>
+  <!-- Base plinth -->
+  <path d="M62 96 L168 96 L160 110 L70 110 Z"
+        fill="url(#anvilBase)" stroke="#0d1018" stroke-width="2.4" stroke-linejoin="round"/>
+  <!-- Pillar between body and base -->
+  <rect x="92" y="70" width="46" height="26" fill="url(#anvilBody)"
+        stroke="#1d2330" stroke-width="2.4"/>
+  <!-- Highlight along top face -->
+  <line x1="74" y1="34" x2="158" y2="34" stroke="#e6ecf5" stroke-width="1.2" opacity="0.7"/>
 </svg>