fix: rename Homelab-Docs → oikos across all active files; add public enrollment route

internal/httpapi/server.go

@@ -94,6 +94,25 @@ func NewHandler(ctx context.Context, pool *db.Pool, cfg config.Config) http.Hand
 		w.Write([]byte(`{"status":"ok"}`))
 	})
 
+	// Client enrollment — unauthenticated (IP-gated in handler).
+	// Registered on base router BEFORE HandlerWithOptions so it
+	// bypasses the combinedAuth middleware applied to all /api/v1/*.
+	r.Post("/api/v1/clients/enroll", func(w http.ResponseWriter, req *http.Request) {
+		var body gen.EnrollRequest
+		if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
+			writeProblem(w, req, http.StatusBadRequest, "invalid request body", err.Error())
+			return
+		}
+		resp, err := s.EnrollClient(req.Context(), gen.EnrollClientRequestObject{Body: &body})
+		if err != nil {
+			writeProblemFromErr(w, req, err)
+			return
+		}
+		if err := resp.VisitEnrollClientResponse(w); err != nil {
+			writeProblem(w, req, http.StatusInternalServerError, "response encoding failed", err.Error())
+		}
+	})
+
 	strict := gen.NewStrictHandlerWithOptions(s, nil, gen.StrictHTTPServerOptions{
 		RequestErrorHandlerFunc: func(w http.ResponseWriter, req *http.Request, err error) {
 			writeProblem(w, req, http.StatusBadRequest, "bad request", err.Error())