Turn provisioning tickets into NetBox tenants/devices/interfaces

Summary

• Adds the operator-driven Apply step on /tickets/{id}: resolves a ticket's rack/tenant/ISO choices against live NetBox/Proxmox, then creates the matching NetBox tenant + device + interfaces and hands off to the existing, unmodified /devices/{id} plan/apply pipeline for the actual Proxmox VM. No changes to internal/apply/internal/diff.
• Renames the intake API's os/extra_hardware fields to iso/hardware (breaking change to the already-shipped, still-unused-in-anger POST /api/v1/provision-requests), and adds a required package field (VM1-VM4/IPv6-only) supplying the device's baseline hardware.
• Raises a separate, trackable /ixp-requests ticket per AMS-IX/FrysIX port ask at Apply time — nothing exists in NetBox for these until the exchange responds, so this is purely a manual-follow-up tracker.

Before this can be deployed

Two values need operator/live-NetBox confirmation — not blocking merge, but required before this ships live (see the plan's "open questions" section, and the doc comments on model.Location/.env.example):

• RAX_KLIENT_VLAN_AMS/_FRA and RAX_KLIENT_VSWITCH_AMS/_FRA — the standard client-uplink VLAN name + Proxmox bridge per location. No default exists to infer these from.
• Confirm store.ProxmoxEnvironment.Name is exactly amsterhost/frahost (checked against /settings/proxmox) — model.Location.ProxmoxEnv assumes this.

Test plan

• go build ./... && go vet ./... && gofmt -l . clean
• go test ./... — full suite passes, including new coverage for model.Validate (package field), netbox (tenant lookup/create, device/interface create, VLAN lookup, IP dns_name), store (ixp_tickets, new provision_requests columns, a migration test seeding a pre-MR-shaped row), and web (loadTicketPlan's rack/tenant/ISO resolution, all four new ticket POST handlers, applyTicketHandler's happy path/tenant-reuse/blocked/already-applied/CSRF cases, and the new /ixp-requests pages)
• Manual: submit a ticket via the agent API, walk /tickets/{id} through rack/tenant/ISO resolution and Apply, confirm the NetBox tenant/device/interfaces look right and /devices/{id} shows a real plan — deferred to after the two config values above are set

🤖 Generated with Claude Code

https://claude.ai/code/session_01MLkpCZnHSXn3kQNXM1WBTM