feat(pxe-boot): add FreeIPA Server (Rocky Linux 9) iPXE menu entry

Adds an unattended install option to the PXE boot menu that installs
Rocky Linux 9 and configures FreeIPA on the domain-controller.sweet.home
host without any operator interaction after selecting the menu entry.

How it works:
- fetch-rocky-pxeboot.service downloads the Rocky 9 Anaconda pxeboot
  kernel and initrd from the Rocky mirror on first pxe-boot deploy
  (idempotent, same pattern as fetch-debian-netboot)
- rocky-freeipa.ipxe boots Anaconda with inst.ks pointing at the
  hosted Kickstart and net.ifnames=0 biosdevname=0 for stable eth0
- rocky-freeipa.ks (generated, includes vars.adminSshKey) performs:
  - Minimal Rocky 9 install with ipa-server + ipa-server-dns
  - Static IP 192.168.2.138 via NM connection file written in %post
  - /etc/hosts fixed for FreeIPA FQDN requirement
  - Random DM + admin passwords generated and saved to
    /root/ipa-credentials.txt (chmod 600, never hardcoded)
  - freeipa-first-boot.service oneshot enabled to run
    ipa-server-install on the first real boot (~20 min)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015Jbvxx4xbHVcx1NkK3vtmK

docs/pxe-boot.md

@@ -73,6 +73,7 @@ The generated menu currently exposes entries for:
 - NixOS Auto-Installer
 - NixOS Minimal
 - Debian Minimal
+- FreeIPA Server (Rocky Linux 9)
 - SystemRescue environment
 - iPXE shell
 - Reboot
@@ -126,6 +127,43 @@ systemctl restart fetch-debian-netboot.service
 To update to a different Debian release, change `debianRelease` in
 `modules/build-types/pxe-boot.nix` and redeploy.
 
+The **FreeIPA Server (Rocky Linux 9)** entry chains
+`http://<pxeServerIp>/rocky-freeipa.ipxe`, which boots the Rocky Linux 9
+Anaconda installer with a Kickstart file (`rocky-freeipa.ks`) hosted on the
+same server. The `fetch-rocky-pxeboot.service` oneshot downloads the pxeboot
+kernel and initrd from the Rocky Linux mirror on first boot (idempotent):
+
+```text
+/srv/pxe/http/rocky/vmlinuz     (Rocky Linux 9 Anaconda pxeboot kernel)
+/srv/pxe/http/rocky/initrd.img  (Rocky Linux 9 Anaconda pxeboot initrd)
+```
+
+The Kickstart file is generated from the NixOS module and staged at
+`/srv/pxe/http/rocky-freeipa.ks`. It performs a fully unattended install:
+
+1. Installs Rocky Linux 9 with `ipa-server` + `ipa-server-dns` packages
+2. Configures static IP `192.168.2.138`, hostname `domain-controller.sweet.home`
+3. Creates user `wayne` with the `adminSshKey` from `variables.nix`
+4. Generates random IPA passwords and writes them to `/root/ipa-credentials.txt`
+5. Creates a `freeipa-first-boot.service` oneshot that runs `ipa-server-install`
+   on first reboot (~20 minutes)
+
+After the install completes:
+- SSH in as `wayne@domain-controller` using the admin key
+- Monitor FreeIPA install progress: `sudo tail -f /root/freeipa-install.log`
+- Retrieve credentials: `sudo cat /root/ipa-credentials.txt` (save to password manager)
+- Configure Pi-hole: `server=/sweet.home/192.168.2.138` in dnsmasq
+
+To refresh the pxeboot files (e.g. after a Rocky point release):
+
+```bash
+rm /srv/pxe/http/rocky/vmlinuz /srv/pxe/http/rocky/initrd.img
+systemctl restart fetch-rocky-pxeboot.service
+```
+
+To update to a different Rocky release, change `rockyRelease` in
+`modules/build-types/pxe-boot.nix` and redeploy.
+
 The SystemRescue entry expects the source ISO at:
 
 ```text
@@ -161,6 +199,10 @@ curl http://pxe-boot/menu.ipxe
 curl http://pxe-boot/debian.ipxe
 curl -I http://pxe-boot/debian/linux
 curl -I http://pxe-boot/debian/initrd.gz
+curl http://pxe-boot/rocky-freeipa.ipxe
+curl http://pxe-boot/rocky-freeipa.ks
+curl -I http://pxe-boot/rocky/vmlinuz
+curl -I http://pxe-boot/rocky/initrd.img
 curl http://pxe-boot/systemrescue.ipxe
 curl -I http://pxe-boot/systemrescue/sysresccd/boot/x86_64/vmlinuz
 curl -I http://pxe-boot/systemrescue/sysresccd/boot/x86_64/sysresccd.img