v0.5.2: FleetDM login split, 3-slot branding, unattended installs

Authentication / login:
- Separate the local username/password form from the SSO "Sign in with …"
  button (FleetDM-style divider + optional IdP logo); credential fields no
  longer double as the SSO trigger. Settings → SSO copy now says SAML is live.

Branding — three slots (light / dark / client) on one row:
- Light/Dark feed the top-left mark + sign-in page by active theme (with
  cross-theme fallback; theme toggle swaps the logo live). Client feeds the
  PXE boot-menu background. Favicon pinned to the bundled mark via a new
  /assets/favicon.svg endpoint. Legacy single logo migrates to dark + client.
- BrandingStore refactored to per-slot storage; /api/branding/logo/:slot.

Unattended installs (Storage → Advanced):
- New UnattendedStore (iso-store) + /api/unattended upload/list/delete and a
  public templated serve at /unattended/:id (+ NoCloud seed dir for
  autoinstall). Accepts .ks/.cfg/.seed/.yaml/.yml/.xml/user-data; classified
  on upload; stored in its own unattended/ dir, never the ISO listing/menu.
- {{HOSTNAME}}/{{IP}}/{{MAC}} substituted per host at serve time.

Host pins + Queue profiles:
- HostBinding + QueueEntry carry an optional DeployProfile (auto_hostname /
  auto_ip / unattended_file). Hosts pin form + a per-device Queue "Profile"
  button collect them. On boot, a matched MAC has the right kernel arg
  injected (inst.ks= / preseed url= / autoinstall ds=nocloud-net) and the
  hostname/IP templated into the served answer file. DHCP stays proxy-only.

Storage:
- Remote shares default protocol is now NFS; updated descriptive copy.

235 tests green, clippy clean. Still a single static musl binary, pure Rust.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/http-api/src/ipxe_script.rs

@@ -460,8 +460,21 @@ pub fn render_queue_entry(base_url: &str) -> String {
 }
 
 /// Per-entry boot script (same as Phase 1, with extra_kernel_args appended).
+///
+/// `unattended_args` (v0.5.2) carries the per-host unattended-install
+/// kernel arguments (`inst.ks=…`, `auto=true … url=…`, or
+/// `autoinstall ds=nocloud-net;s=…`) when the requesting MAC has a
+/// deployment profile with an answer file selected. It's appended to the
+/// Linux kernel command line after the operator's global extra args, and
+/// ignored for Windows (wimboot) / sanboot entries which don't take a
+/// kernel cmdline.
 #[must_use]
-pub fn render_entry(entry: &BootEntry, settings: &Settings, base_url: &str) -> String {
+pub fn render_entry(
+    entry: &BootEntry,
+    settings: &Settings,
+    base_url: &str,
+    unattended_args: Option<&str>,
+) -> String {
     let mut s = String::new();
     let base = base_url.trim_end_matches('/');
     let _ = writeln!(s, "#!ipxe");
@@ -477,6 +490,12 @@ pub fn render_entry(entry: &BootEntry, settings: &Settings, base_url: &str) -> S
                 cmdline.push(' ');
                 cmdline.push_str(settings.extra_kernel_args.trim());
             }
+            if let Some(extra) = unattended_args {
+                if !extra.trim().is_empty() {
+                    cmdline.push(' ');
+                    cmdline.push_str(extra.trim());
+                }
+            }
             let _ = writeln!(s, "kernel {base}/{kernel_url} {cmdline}");
             for u in initrd_urls {
                 let _ = writeln!(s, "initrd {base}/{u}");