v0.3.0 — rebrand: PXEForge → OpenPXE, Gated → Queued Deployment

Full rename to match the openpxe.com brand. The product now reads as a
polished open-source project rather than a personal-tool nickname:
the anvil/forge metaphor is gone, replaced with the rainbow-horizon
brand mark from the marketing site.

## Naming changes

**PXEForge → OpenPXE** everywhere it's user-visible or developer-
facing:
- All 8 crate package names (`pxeforge-*` → `openpxe-*`).
- The bin crate dir + binary (`crates/pxeforge` → `crates/openpxe`,
  `bin = "openpxe"`).
- Env vars: `PXEFORGE_*` → `OPENPXE_*` (no compat shim — pre-beta).
- Tracing targets: `pxeforge::*` → `openpxe::*`.
- Prometheus metrics: `pxeforge_*` → `openpxe_*` (pre-beta; nobody
  has dashboards on these yet).
- Container image: `gitea.milesward.dev/mward4/openpxe:0.3.0`.
- All in-tree paths: `/var/lib/openpxe/{isos,work,smb}`,
  `/usr/share/openpxe/ipxe`, `/etc/openpxe/...`.
- Unraid template renamed `pxeforge.xml` → `openpxe.xml`.
- README, NEXT_PHASE.md, architecture.md, comments, and the WebUI
  brand string.

**Gated Deployment → Queued Deployment** as the user-facing concept:
- `Settings::TimeoutAction::GatedDeployment` →
  `QueuedDeployment` (with `#[serde(alias = "gated_deployment")]`
  so v0.2.0 settings.json files keep deserializing).
- Rust types: `Gate` → `QueueEntry`, `GateQueue` → `DeploymentQueue`,
  `GateInner` → `QueueEntryInner`.
- File: `crates/core/src/gate.rs` → `crates/core/src/queue.rs`.
- HTTP routes: `/api/gate/*` → `/api/queue/*`. The JSON list key
  flipped from `"gates"` to `"entries"` to match.
- iPXE shortcut: `/boot/_gate.ipxe` → `/boot/_queue.ipxe`. The
  top-level menu's item id is now `queue` instead of `gate`.
- WebUI sidebar tab: "Forge Gate" → "Queue".
- Field on `AppState`: `gates` → `queue`.

## Brand assets

The anvil + forging-sparks logos are dropped:
- `logo.svg` is now a 24×24 medallion filled with the
  `rainbow-horizon` gradient from openpxe.com (sliding hue rotation
  via SMIL on the gradient stops, no JS needed).
- `anvil-forge.svg` renamed to `loader.svg` and rebuilt as a 64×64
  louder version of the same disc — used for page-load transitions
  and the imaging-progress widget. Adds a subtle scale pulse and a
  white inner-glow so it has dimensionality on either theme.

## CSS rename

- `.forge-progress` → `.queue-progress`
- `.forge-progress .anvil` → `.queue-progress .mark`
- `@keyframes forge-sheen` → `queue-sheen`
- `.loader .anvil` → `.loader .mark`
- "Heating the forge…" loader text → "Loading…"

The rest of the layout is untouched. Light/dark theme tokens and the
sidebar/topbar structure carry over from v0.2.0 unchanged — the
brief was "keeping the UI similar."

## Validation

- `cargo build --workspace` — clean.
- `cargo clippy --workspace --all-targets` — no warnings.
- `cargo test --workspace` — **66 tests passing**, same as v0.2.0.
- Local smoke run against the rebuilt release binary verifies:
  - `/boot.ipxe` emits `Queued Deployment` + `item queue` + chains
    `/boot/_queue.ipxe`
  - `/api/queue` returns `{count, entries}`
  - `/metrics` emits `openpxe_queue_count` (renamed)
  - `/assets/logo.svg` and `/assets/loader.svg` serve the new
    rainbow brand SVGs
  - `/api/status` reports version `0.3.0`

## Migration notes for operators on v0.2.0

- Container image path changed: pull
  `gitea.milesward.dev/mward4/openpxe:0.3.0` (not `pxeforge:`).
- Bind mounts: `/var/lib/openpxe/{isos,work,smb}` (not `pxeforge`).
  Move the host path or update the template.
- Env vars: replace `PXEFORGE_*` with `OPENPXE_*`. The Unraid
  template at `deploy/unraid/openpxe.xml` is already updated.
- `settings.json` carries over transparently — the
  `gated_deployment` value is accepted as an alias.
- HTTP API: any external scripts that hit `/api/gate/*` need to
  switch to `/api/queue/*`. The JSON envelope key is `entries`
  instead of `gates`.

deploy/openshift/00-namespace.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: pxeforge
+  name: openpxe
   labels:
     # Allow privileged pods (host-network) in this namespace only. The pod
     # itself still runs non-root with only NET_BIND_SERVICE — privileged

deploy/openshift/10-scc.yaml

@@ -1,5 +1,5 @@
 ---
-# Custom SCC for PXEForge.
+# Custom SCC for OpenPXE.
 #
 # The default `restricted-v2` SCC blocks host network and all capabilities,
 # which PXE cannot tolerate: DHCPDISCOVER is an L2 broadcast that CNI overlays
@@ -19,10 +19,10 @@
 apiVersion: security.openshift.io/v1
 kind: SecurityContextConstraints
 metadata:
-  name: pxeforge-scc
+  name: openpxe-scc
   annotations:
     kubernetes.io/description: >-
-      Minimal SCC for PXEForge: host network + NET_BIND_SERVICE only, no raw
+      Minimal SCC for OpenPXE: host network + NET_BIND_SERVICE only, no raw
       sockets, no privileged mode.
 allowPrivilegedContainer: false
 allowPrivilegeEscalation: false
@@ -54,27 +54,27 @@ volumes:
 users: []
 groups: []
 ---
-# Bind the SCC to the pxeforge service account.
+# Bind the SCC to the openpxe service account.
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: pxeforge-scc-use
+  name: openpxe-scc-use
 rules:
   - apiGroups: ["security.openshift.io"]
     resources: ["securitycontextconstraints"]
-    resourceNames: ["pxeforge-scc"]
+    resourceNames: ["openpxe-scc"]
     verbs: ["use"]
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: pxeforge-scc-use
-  namespace: pxeforge
+  name: openpxe-scc-use
+  namespace: openpxe
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: pxeforge-scc-use
+  name: openpxe-scc-use
 subjects:
   - kind: ServiceAccount
-    name: pxeforge
-    namespace: pxeforge
+    name: openpxe
+    namespace: openpxe

deploy/openshift/20-sa-pvc-config.yaml

@@ -2,29 +2,29 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: pxeforge
-  namespace: pxeforge
+  name: openpxe
+  namespace: openpxe
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: pxeforge-config
-  namespace: pxeforge
+  name: openpxe-config
+  namespace: openpxe
 data:
   # Toggle DHCP proxy on or off. "proxy" = answer PXE clients alongside an
   # existing DHCP server. "disabled" = require operator to point an external
   # DHCP at us via next-server/filename.
-  PXEFORGE_DHCP_MODE: "proxy"
+  OPENPXE_DHCP_MODE: "proxy"
   # Override if auto-detection picks the wrong NIC in multi-homed pods.
   # Leave unset to auto-detect from the node's primary IPv4.
-  # PXEFORGE_PUBLIC_IP: "10.0.0.5"
-  PXEFORGE_LOG: "info,pxeforge=info"
+  # OPENPXE_PUBLIC_IP: "10.0.0.5"
+  OPENPXE_LOG: "info,openpxe=info"
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: pxeforge-isos
-  namespace: pxeforge
+  name: openpxe-isos
+  namespace: openpxe
 spec:
   # ReadWriteOnce is fine — we deploy as a single replica since DHCP proxy
   # coordination across replicas is not useful (clients hit whichever node

deploy/openshift/30-deployment.yaml

@@ -2,10 +2,10 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: pxeforge
-  namespace: pxeforge
+  name: openpxe
+  namespace: openpxe
   labels:
-    app.kubernetes.io/name: pxeforge
+    app.kubernetes.io/name: openpxe
 spec:
   # Single replica by design (see PVC comment). If HA is needed later, split
   # the HTTP/web plane (scalable, stateless) from the DHCP-proxy/TFTP plane
@@ -15,13 +15,13 @@ spec:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: pxeforge
+      app.kubernetes.io/name: openpxe
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: pxeforge
+        app.kubernetes.io/name: openpxe
     spec:
-      serviceAccountName: pxeforge
+      serviceAccountName: openpxe
       # L2 broadcast (DHCPDISCOVER) does not cross most CNI overlays into
       # pod netns. Host network is the working path.
       hostNetwork: true
@@ -33,8 +33,8 @@ spec:
         runAsUser: 10001
         fsGroup: 10001
       containers:
-        - name: pxeforge
-          image: ghcr.io/casperadmin/pxeforge:0.1.0
+        - name: openpxe
+          image: ghcr.io/casperadmin/openpxe:0.1.0
           imagePullPolicy: IfNotPresent
           ports:
             - name: dhcp
@@ -59,7 +59,7 @@ spec:
               protocol: TCP
           envFrom:
             - configMapRef:
-                name: pxeforge-config
+                name: openpxe-config
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
@@ -70,9 +70,9 @@ spec:
               add: ["NET_BIND_SERVICE"]
           volumeMounts:
             - name: isos
-              mountPath: /var/lib/pxeforge/isos
+              mountPath: /var/lib/openpxe/isos
             - name: work
-              mountPath: /var/lib/pxeforge/work
+              mountPath: /var/lib/openpxe/work
             - name: tmp
               mountPath: /tmp
           readinessProbe:
@@ -97,7 +97,7 @@ spec:
       volumes:
         - name: isos
           persistentVolumeClaim:
-            claimName: pxeforge-isos
+            claimName: openpxe-isos
         - name: work
           emptyDir: {}
         - name: tmp

deploy/openshift/40-service-route.yaml

@@ -5,14 +5,14 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: pxeforge
-  namespace: pxeforge
+  name: openpxe
+  namespace: openpxe
   labels:
-    app.kubernetes.io/name: pxeforge
+    app.kubernetes.io/name: openpxe
 spec:
   type: ClusterIP
   selector:
-    app.kubernetes.io/name: pxeforge
+    app.kubernetes.io/name: openpxe
   ports:
     - name: http
       port: 80
@@ -29,12 +29,12 @@ spec:
 apiVersion: route.openshift.io/v1
 kind: Route
 metadata:
-  name: pxeforge
-  namespace: pxeforge
+  name: openpxe
+  namespace: openpxe
 spec:
   to:
     kind: Service
-    name: pxeforge
+    name: openpxe
     weight: 100
   port:
     targetPort: http