feat: TypeScript bastion rewrite (initial scaffold)

Full rewrite of the bash bastion.sh into a TypeScript application:
- Fastify HTTP server with typed routes (dispatch, kickstart, API)
- Commander CLI (serve, install, list, reprovision)
- Kickstart templates as TypeScript template literals (no more heredoc hell)
- dnsmasq management via execa subprocess
- Merged machine list view (hardware + install info in one table)
- Containerized via podman-compose (Dockerfile + docker-compose.yml)
- All partition logic preserved (LVM, reprovision detection, role-based)

Not yet tested end-to-end — needs VM validation before replacing bash version.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bastion/src/cli/commands/serve.ts

@@ -0,0 +1,40 @@
+// CLI command: serve
+// Start the bastion server (HTTP + dnsmasq).
+
+import type { Command } from "commander";
+import { startBastion } from "../../server/main.js";
+
+export function registerServeCommand(program: Command): void {
+  program
+    .command("serve")
+    .description("Start the bastion server (HTTP + dnsmasq PXE)")
+    .option("--port <port>", "HTTP port", "8080")
+    .option("--dir <dir>", "Bastion data directory", "/tmp/lab-bastion")
+    .option("--domain <domain>", "Internal domain for hostnames", "ad.itaz.eu")
+    .option("--dhcp-mode <mode>", "DHCP mode: proxy or full", "proxy")
+    .option("--fedora <version>", "Fedora version", "43")
+    .option("--arch <arch>", "Architecture", "x86_64")
+    .option("--timezone <tz>", "Timezone", "Europe/London")
+    .option("--locale <locale>", "Locale", "en_GB.UTF-8")
+    .action(async (opts: {
+      port: string;
+      dir: string;
+      domain: string;
+      dhcpMode: string;
+      fedora: string;
+      arch: string;
+      timezone: string;
+      locale: string;
+    }) => {
+      await startBastion({
+        httpPort: parseInt(opts.port, 10),
+        bastionDir: opts.dir,
+        domain: opts.domain,
+        dhcpMode: opts.dhcpMode as "proxy" | "full",
+        fedoraVersion: opts.fedora,
+        arch: opts.arch,
+        timezone: opts.timezone,
+        locale: opts.locale,
+      });
+    });
+}