story(boot-server): implement boot profile API

[Zaba505]

Description

Implement HTTP REST API endpoints for managing boot profiles. Boot profiles define reusable boot configurations (kernel paths, initrd paths, kernel command line arguments, cloud-init templates) that can be assigned to multiple machines.

Profiles provide a layer of abstraction between raw boot images and machine mappings, allowing administrators to define configurations like "ubuntu-22.04-server" or "talos-kubernetes-worker" that reference specific images and settings.

Acceptance Criteria

• Endpoints created in services/boot-server/endpoint/profiles.go:
  • POST /api/v1/profiles - Create new profile
  • GET /api/v1/profiles - List all profiles
  • GET /api/v1/profiles/{profile_id} - Get profile details
  • PUT /api/v1/profiles/{profile_id} - Update profile
  • DELETE /api/v1/profiles/{profile_id} - Delete profile
• Implements OpenAPI-first handler pattern (z5labs/humus):
  • Request/response schemas defined via OpenAPI
  • Proper JSON content types
• POST /api/v1/profiles implementation:
  • Accepts JSON body: { name, image_id, kernel_cmdline, cloud_init_template, metadata }
  • Validates profile name is unique
  • Validates image_id exists in Firestore images collection
  • Validates kernel command line syntax (basic validation)
  • Validates cloud-init template YAML (if provided)
  • Generates unique profile ID (UUID or name-based)
  • Stores profile in Firestore: profiles/{profile_id}
  • Returns HTTP 201 Created with profile details
• GET /api/v1/profiles implementation:
  • Lists all boot profiles from Firestore
  • Supports pagination (limit, offset or cursor-based)
  • Supports filtering by image_id, name (optional)
  • Returns HTTP 200 OK with array of profiles
• GET /api/v1/profiles/{profile_id} implementation:
  • Retrieves specific profile from Firestore
  • Returns HTTP 404 Not Found if profile doesn't exist
  • Returns HTTP 200 OK with full profile details
• PUT /api/v1/profiles/{profile_id} implementation:
  • Updates profile configuration
  • Validates new image_id exists
  • Validates kernel command line and cloud-init template
  • Updates Firestore document
  • Returns HTTP 200 OK with updated profile
• DELETE /api/v1/profiles/{profile_id} implementation:
  • Checks if profile is in use by any machines (query Firestore)
  • Returns HTTP 409 Conflict if profile is actively mapped to machines
  • Deletes profile from Firestore
  • Returns HTTP 204 No Content on success
• Profile data model:
  • id - Unique identifier
  • name - Human-readable name (e.g., "ubuntu-22.04-server")
  • image_id - Reference to boot image
  • kernel_cmdline - Kernel command line arguments (e.g., "console=tty0 console=ttyS0")
  • cloud_init_template - Cloud-init YAML template with variable substitution
  • metadata - Additional key-value metadata
  • created_at, updated_at - Timestamps
• Authentication/authorization:
  • Validate admin credentials (IAM-based or API key)
  • Returns HTTP 401 Unauthorized if not authenticated
  • Returns HTTP 403 Forbidden if not authorized
• OpenTelemetry instrumentation:
  • Log profile operations with profile_id, operation type
  • Metrics: profile creation count, update count, active profiles
  • Trace context propagation
• Error handling:
  • Proper HTTP status codes (400, 401, 403, 404, 409, 500)
  • Structured error responses
  • Handle Firestore errors gracefully
• Unit tests:
  • Test profile validation (name uniqueness, image references)
  • Test cloud-init template validation
  • Test delete with active machine references (conflict)
  • Mock Firestore client

Related Issues

Implements ADR-0005 - Network Boot Infrastructure Implementation on Google Cloud

Depends on #605 (API documentation)
Depends on #611 (boot server scaffold)
Depends on #609 (Firestore module)
Related to #615 (machine mappings reference profiles)
Related to #601