feat: TypeScript bastion rewrite (initial scaffold)

Full rewrite of the bash bastion.sh into a TypeScript application:
- Fastify HTTP server with typed routes (dispatch, kickstart, API)
- Commander CLI (serve, install, list, reprovision)
- Kickstart templates as TypeScript template literals (no more heredoc hell)
- dnsmasq management via execa subprocess
- Merged machine list view (hardware + install info in one table)
- Containerized via podman-compose (Dockerfile + docker-compose.yml)
- All partition logic preserved (LVM, reprovision detection, role-based)

Not yet tested end-to-end — needs VM validation before replacing bash version.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bastion/stack/docker-compose.yml

@@ -0,0 +1,21 @@
+services:
+  bastion:
+    build:
+      context: ..
+      dockerfile: stack/Dockerfile
+    network_mode: host
+    restart: unless-stopped
+    env_file: .env
+    volumes:
+      - bastion-state:/data/state
+      - bastion-tftp:/data/tftp
+      - bastion-http:/data/http
+      - ${SSH_KEY_PATH:-~/.ssh}:/root/.ssh:ro
+    cap_add:
+      - NET_ADMIN
+      - NET_RAW
+
+volumes:
+  bastion-state:
+  bastion-tftp:
+  bastion-http: