fix(pxe-boot): use pxe-service for proxy DHCP initial boot offers

dnsmasq 2.93 does not send proxy DHCP offers from dhcp-boot alone in proxy
mode — pxe-service is required to trigger proxy offers for the initial boot.

Replace the dhcp-boot-based arch detection with pxe-service entries for
arch 0 (BIOS), 7 (EFI BC / OVMF), and 9 (EFI x86-64), then use dhcp-boot
only for the iPXE second-boot HTTP chain (tag:ipxe clients). Add log-dhcp
for post-deploy verification.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/build-types/pxe-boot.nix

@@ -427,18 +427,21 @@ in
       # Without this dnsmasq tries to bind port 53 which systemd-resolved
       # already owns, causing startup failure.
       port = 0;
-      dhcp-range = [ "192.168.2.0,proxy" ];
-      dhcp-match = [
-        "set:ipxe,175"
-        "set:efi64,option:client-arch,7"
-        "set:efi64,option:client-arch,9"
-      ];
+      log-dhcp = true;
+      dhcp-range = "192.168.2.0,proxy";
+      # Detect iPXE clients on the second DHCP round (after loading the
+      # iPXE binary) so we can serve the HTTP menu instead of TFTP.
+      dhcp-match = "set:ipxe,175";
       dhcp-userclass = "set:ipxe,iPXE";
-      dhcp-boot = [
-        "tag:ipxe,tag:efi64,http://${vars.pxeServerIp}/boot.ipxe"
-        "tag:ipxe,http://${vars.pxeServerIp}/boot.ipxe"
-        "tag:efi64,ipxe.efi,,${vars.pxeServerIp}"
-        "undionly.kpxe,,${vars.pxeServerIp}"
+      # iPXE second boot: chain to HTTP boot menu.
+      dhcp-boot = "tag:ipxe,http://${vars.pxeServerIp}/boot.ipxe";
+      # Initial boot: use pxe-service so dnsmasq sends proxy DHCP offers.
+      # dhcp-boot alone does not trigger proxy offers in dnsmasq 2.93.
+      # Arch 0 = BIOS, 7 = EFI BC (OVMF), 9 = EFI x86-64.
+      pxe-service = [
+        "0,\"Network Boot\",undionly.kpxe,${vars.pxeServerIp}"
+        "7,\"Network Boot\",ipxe.efi,${vars.pxeServerIp}"
+        "9,\"Network Boot\",ipxe.efi,${vars.pxeServerIp}"
       ];
     };
   };