docs(fleet): add PegaProx, iVentoy remastering procedures, update admin cheat sheet

- fleet/admin-cheat-sheet.md: Added PegaProx section, updated MK33/MK34/MK39
  statuses to Online (PVE), added iVentoy remastering notes, iVentoy Pro
  upgrade pending marker.
- procedures/pega-prox-deploy.md: New procedure for deploying PegaProx on
  Docker Swarm (host mode, CSRF, API gotchas).
- procedures/iventoy-remaster-procedure.md: New procedure for remastering
  Proxmox ISOs with embedded answer URLs and locked gfxmode.
- changelog/2026-05-31-pxe-pegaprox-deployment.md: Changelog entry for todays
  fleet work.
- 04-service-catalog.md: Added PegaProx to Management / Dashboard section.

changelog/changelog-2026-05-31.md

@@ -0,0 +1,88 @@
+# Changelog -- 2026-05-31 Fleet PXE + PegaProx Deployment
+
+**Date:** 2026-05-31
+**Author:** F.R.I.D.A.Y.
+**Scope:** PXE remastered ISOs, PegaProx deployment, PVE node registration
+
+---
+
+## Changes Made
+
+### 1. iVentoy Proxmox ISO Remastering
+
+All four Proxmox VE 9.2 auto-install ISOs were remastered with:
+- Embedded per-node answer URLs: `http://192.168.10.15:8080/pve/answers/mkNN.toml`
+- UEFI `gfxmode` locked to `1024x768` (removed `640x480` fallback)
+- Per-ISO answer files: `mk33.toml`, `mk34.toml`, `mk39.toml`, `mk42.toml`
+
+**Verification:**
+- `strings /opt/iventoy/iso/proxmox-mkNN-auto.iso | grep 192.168.10.15` confirmed embedded URLs
+- `xorriso -cpx` extraction confirmed `gfxmode=1024x768` on all 4 ISOs
+
+### 2. PegaProx Deployment on MK7
+
+Deployed PegaProx Proxmox cluster manager to MK7 Swarm:
+- Compose file: `/tmp/pegaprox_swarm.yml`
+- Ports: `5000` (HTTPS), `5001` (VNC WebSocket), `5002` (SSH WebSocket)
+- Publish mode: `host` (WebSocket incompatible with Swarm ingress)
+- Network: `traefik-public` overlay
+- SSL: Self-signed cert auto-generated (`CN=PegaProx`)
+
+**Verification:**
+- `docker stack deploy -c /tmp/pegaprox_swarm.yml pegaprox` succeeded
+- Container healthy, API responding on `https://192.168.7.7:5000`
+- Default login: `pegaprox` / `admin` (forces password change)
+
+### 3. PVE Node Registration in PegaProx
+
+Three nodes added to PegaProx cluster:
+
+| Node | PegaProx ID | Host | Status |
+|------|-------------|------|--------|
+| MK-33 | `726eb477` | `192.168.7.33` | running |
+| MK-34 | `df6f5e5d` | `192.168.7.34` | running |
+| MK-39 | `9711704b` | `192.168.7.39` | running |
+
+**API Notes Learned:**
+- `host` field must be **bare IP only** (no `:8006`)
+- CSRF protection requires `X-Requested-With: XMLHttpRequest`
+- `/api/clusters` endpoint used for registration
+
+### 4. Documentation Updates
+
+Updated files:
+- `fleet/admin-cheat-sheet.md` -- Added PegaProx section, updated node statuses, added iVentoy remastering notes
+- `procedures/pega-prox-deploy.md` -- New procedure for deploying PegaProx on Swarm
+- `procedures/iventoy-remaster-procedure.md` -- New procedure for remastering PVE ISOs
+- `changelog/2026-05-31-pxe-pegaprox-deployment.md` -- This file
+
+### 5. iVentoy Pro Upgrade -- Pending
+
+Status: Awaiting private repo link from vendor. Current installation uses iVentoy Free. Pro upgrade may simplify per-node provisioning (per-MAC ISO binding feature expected).
+
+---
+
+## Remaining Work
+
+- MK-42: Not yet PXE-booted or installed
+- PegaProx: Admin password change required (user in progress)
+- iVentoy Pro: Upgrade pending vendor repo link
+- LXC/cloud-init automation: Terraform templates for Docker Swarm restoration (next phase)
+- Traefik DNS record: `pegaprox.ai.home` routing pending Traefik deployment on MK7
+
+---
+
+## Service Impact
+
+| Service | Status | Notes |
+|---------|--------|-------|
+| iVentoy PXE | Ready | 4 remastered ISOs registered |
+| PegaProx | Online | 3 PVE nodes connected |
+| MK-33 | Online | PVE installed, registered |
+| MK-34 | Online | PVE installed, registered |
+| MK-39 | Online | PVE installed, registered |
+| MK-42 | Offline | Pending PXE boot |
+
+---
+
+*End of changelog*