feat(atlas): Phase B — substrate from the live cluster

The substrate machines are now rendered from the live k3s nodes (arch, cpu,
memory, GPU, k3s version), read in-cluster via the mounted ServiceAccount with a
stdlib HTTP client (no client-go) and a 30s cache; falls back to the authored
substrate whenever the cluster is unreachable. Placement per the homelab decision
"in-cluster only for in-workload ops" — a running web app rendering live data fits.

HostsFromNodes parser built test-first. RBAC (read-only node-reader SA) shipped in
infra k3s/apps/cad-atlas/.

Verified: go build/vet/lint(0)/test green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/atlas/cluster_test.go

@@ -0,0 +1,38 @@
+package atlas_test
+
+import (
+	"reflect"
+	"testing"
+
+	"git.d-ma.be/mathias/cad-atlas/internal/atlas"
+)
+
+func TestHostsFromNodes_DerivesSpecFromNodeStatus(t *testing.T) {
+	nodes := []byte(`{"items":[
+	  {"metadata":{"name":"koala"},
+	   "status":{"capacity":{"cpu":"16","memory":"67108864Ki","nvidia.com/gpu":"1"},
+	             "nodeInfo":{"architecture":"amd64","kubeletVersion":"v1.31.4+k3s1"}}},
+	  {"metadata":{"name":"worker2"},
+	   "status":{"capacity":{"cpu":"8","memory":"33554432Ki"},
+	             "nodeInfo":{"architecture":"arm64","kubeletVersion":"v1.30.0+k3s1"}}}
+	]}`)
+
+	hosts, err := atlas.HostsFromNodes(nodes)
+	if err != nil {
+		t.Fatalf("HostsFromNodes: %v", err)
+	}
+
+	want := []atlas.Host{
+		{Name: "koala", Spec: "amd64 · 16 cpu · 64Gi · 1× GPU · k3s v1.31.4"},
+		{Name: "worker2", Spec: "arm64 · 8 cpu · 32Gi · k3s v1.30.0"},
+	}
+	if !reflect.DeepEqual(hosts, want) {
+		t.Fatalf("hosts = %+v\nwant   %+v", hosts, want)
+	}
+}
+
+func TestHostsFromNodes_ErrorsOnBadJSON(t *testing.T) {
+	if _, err := atlas.HostsFromNodes([]byte("{not json")); err == nil {
+		t.Fatal("expected error on bad JSON, got nil")
+	}
+}