refactor(dhcp,pxe): adopt style guide rules for pub/module visibility

[chet]

This adopts the new style guide rules around module visibility introduced in #4522, applying the correct visibility throughout DHCP, DHCP Server, and PXE.

Primary callouts are:

• Replace unrestricted pub throughout crates/dhcp/**, crates/dhcp-server/src/**, and crates/pxe/src/** with private, pub(super), or pub(crate) visibility based on actual callers.
• Keep the cbindgen-declared Kea hook ABI public and leave generated tonic declarations untouched behind a private module boundary.
• Gate cross-crate mock_api_server support behind an explicit test-support feature, with its mock-only dependency edges enabled by that feature and failure injection kept unit-only.
• Narrow DHCP integration-test fixtures under tests/common/** to the test crates and parent modules that actually use them.
• Remove callerless DHCP response/factory helpers, the redundant machine_free_ntpservers symbol, PXE's unused ExtraMetricLabels extension, and unused PXE error variants.
• Leave the cbindgen-declared Kea hook ABI, gRPC contract, DHCP/PXE protocol behavior, and metric names unchanged.

Tests updated!

Related issues

This supports #4552.

This supports the updated Rust visibility scoping guidelines in STYLE_GUIDE.md, established in #4522.

Type of Change

• Add - New feature or capability
• Change - Changes in existing functionality
• Fix - Bug fixes
• Remove - Removed features or deprecated functionality
• Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

• This PR contains breaking changes

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No testing required (docs, internal refactor, etc.)

All 59 DHCP unit tests, 38 DHCP integration tests, 29 DHCP Server tests, and 28 PXE tests pass. I also ran:

cargo test --locked -p carbide-dhcp --all-targets --all-features
cargo test --locked -p carbide-dhcp-server -p carbide-pxe --all-targets --all-features
cargo test --locked -p carbide-dhcp --no-default-features --all-targets --no-run
cargo check --locked -p carbide-dhcp --lib --no-default-features
cargo clippy --locked -p carbide-dhcp -p carbide-dhcp-server -p carbide-pxe --all-targets --all-features -- -D warnings
cargo make format-nightly
cargo make clippy
cargo make carbide-lints
cargo make check-licenses
cargo make check-bans
cargo make check-workspace-deps
taplo fmt --check crates/dhcp/Cargo.toml
git diff --check

Additional Notes

The initial compiler inventory found 242 overbroad declarations: 184 in DHCP, 35 in DHCP Server, and 23 in PXE. The final 44-file diff also includes the integration-test boundaries and callerless code exposed by that cleanup. The remaining unrestricted pub declarations are limited to the cbindgen-declared C ABI, explicit feature-gated integration-test support, and generated tonic declarations behind a private module.

Ubuntu's path-specific AppArmor profiles for /usr/sbin/kea-dhcp4 and /usr/sbin/kea-dhcp6 denied the test harness's temporary PID and lock paths. I ran the complete DHCP integration suite against SHA-256-identical executable copies outside those profiles, then restored the two temporary launch-path edits byte-for-byte; no temporary path remains in this diff.

Local CodeRabbit and the independent fresh-eyes review returned zero findings. The applicable read-only Claude findings around optional mock dependencies, private cache state, stale comments, and scope-equivalent visibility edits are incorporated. I declined one suggestion to expose unit-only failure injection through the integration-test feature because no integration caller needs that API.

Closes #4552

[chet]

@coderabbitai full_review, thanks!

[coderabbitai]

@chet I will perform a complete review of PR #4647.

✅ Action performed

Full review finished.

[coderabbitai]

Summary by CodeRabbit

• Refactor
  • Streamlined internal interfaces across DHCP and PXE services by limiting implementation details to appropriate service boundaries.
  • Removed unused externally accessible helpers and test utilities without changing runtime behavior.
  • Restricted metrics and routing components while preserving existing request handling, monitoring, and routing functionality.
  • Simplified PXE metric labels by using a bounded value for unmatched routes.
• Tests
  • Limited test support and helper APIs to the scopes where they are needed.

Walkthrough

The PR narrows internal API visibility across the DHCP server, DHCP, DHCP test-support, and PXE crates. It also gates test-support dependencies, removes one exported C-ABI function, removes unused PXE error variants, and limits metric label propagation.

Changes

Internal API encapsulation

Layer / File(s)	Summary
DHCP server visibility scope crates/dhcp-server/src/...	Cache, command-line, gRPC, mode, packet, RPC, utility, metric, and test declarations use narrower visibility.
DHCP crate API scope crates/dhcp/Cargo.toml, crates/dhcp/src/...	Core DHCP declarations use narrower visibility. Test-support dependencies and metrics are conditionally enabled. Mock failure injection is test-only.
DHCP integration-test support crates/dhcp/tests/common/...	Factories, Kea helpers, re-exports, and assertion helpers use crate or parent-module visibility.
PXE API and error scope crates/pxe/src/...	PXE fields, modules, middleware, routes, metrics, and errors use narrower visibility. Extra metric label propagation and unused error variants are removed.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• NVIDIA/infra-controller#4522: Defines visibility-scoping guidelines implemented by this PR.
• NVIDIA/infra-controller#4571: Introduces related dead_code_pub_in_binary cleanup across overlapping DHCP server and PXE code.
• NVIDIA/infra-controller#4505: Overlaps with this PR in DHCP server symbols such as Config, Controller, DhcpMode, packet handling, metrics, cache, and utilities.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 85.54% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the visibility refactor across DHCP and PXE and follows a concise conventional format.
Description check	✅ Passed	The description directly explains the visibility changes, compatibility constraints, removed APIs, feature gating, and validation performed.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

crates/dhcp/tests/common/mod.rs (1)

23-24: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Scope shared test fixtures instead of suppressing lints.

These #[allow(dead_code)] and #[allow(unused_imports)] attributes hide unused fixtures and re-exports in individual integration-test targets. Move each fixture or re-export into the test modules that use it. Keep common/mod.rs limited to genuinely shared items.

As per coding guidelines, avoid #[allow(...)], especially #[allow(dead_code)]; remove unused code or gate test- and feature-specific code appropriately.

Also applies to: 31-32, 34-37, 39-40, 42-47, 53-55

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/dhcp/tests/common/mod.rs` around lines 23 - 24, Remove the
#[allow(dead_code)] and #[allow(unused_imports)] suppressions from
common/mod.rs, including the declarations around kea_v6 and the other listed
fixtures/re-exports. Move each fixture or re-export into the specific
integration-test module that uses it, leaving common/mod.rs only with genuinely
shared items and gating test- or feature-specific code appropriately.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/pxe/src/middleware/metrics.rs`:
- Around line 157-161: Bound the endpoint label in MetricLayer by using the
literal "unknown" whenever MatchedPath is absent, rather than copying the
request URI; preserve matched-route labels unchanged. Add regression tests
covering unmatched requests and requests handled by nested services.

---

Nitpick comments:
In `@crates/dhcp/tests/common/mod.rs`:
- Around line 23-24: Remove the #[allow(dead_code)] and #[allow(unused_imports)]
suppressions from common/mod.rs, including the declarations around kea_v6 and
the other listed fixtures/re-exports. Move each fixture or re-export into the
specific integration-test module that uses it, leaving common/mod.rs only with
genuinely shared items and gating test- or feature-specific code appropriately.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: a48376ea-4742-43ae-a39a-83bf397b241e

📥 Commits

Reviewing files that changed from the base of the PR and between 4f0e11f and 51c4e79.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (43)

• crates/dhcp-server/src/cache.rs
• crates/dhcp-server/src/command_line.rs
• crates/dhcp-server/src/grpc_server.rs
• crates/dhcp-server/src/main.rs
• crates/dhcp-server/src/metrics.rs
• crates/dhcp-server/src/modes/controller.rs
• crates/dhcp-server/src/modes/dpu.rs
• crates/dhcp-server/src/modes/mod.rs
• crates/dhcp-server/src/packet_handler.rs
• crates/dhcp-server/src/rpc/client.rs
• crates/dhcp-server/src/rpc/mod.rs
• crates/dhcp-server/src/util.rs
• crates/dhcp/Cargo.toml
• crates/dhcp/src/cache.rs
• crates/dhcp/src/discovery.rs
• crates/dhcp/src/discovery_v6.rs
• crates/dhcp/src/kea/ffi.rs
• crates/dhcp/src/kea_logger.rs
• crates/dhcp/src/lib.rs
• crates/dhcp/src/machine.rs
• crates/dhcp/src/machine_v6.rs
• crates/dhcp/src/metrics.rs
• crates/dhcp/src/mock_api_server.rs
• crates/dhcp/src/tls.rs
• crates/dhcp/tests/common/dhcp_factory.rs
• crates/dhcp/tests/common/dhcpv6_factory.rs
• crates/dhcp/tests/common/kea.rs
• crates/dhcp/tests/common/kea_v6.rs
• crates/dhcp/tests/common/mod.rs
• crates/pxe/src/common.rs
• crates/pxe/src/config.rs
• crates/pxe/src/extractors/machine_architecture.rs
• crates/pxe/src/extractors/mod.rs
• crates/pxe/src/main.rs
• crates/pxe/src/metrics.rs
• crates/pxe/src/middleware/metrics.rs
• crates/pxe/src/middleware/mod.rs
• crates/pxe/src/routes/cloud_init.rs
• crates/pxe/src/routes/ipxe.rs
• crates/pxe/src/routes/metrics.rs
• crates/pxe/src/routes/mod.rs
• crates/pxe/src/routes/tls.rs
• crates/pxe/src/rpc_error.rs

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[chet]

@coderabbitai full_review, thanks!

[coderabbitai]

@chet: I will perform a complete review of PR #4647.

🐇

✅ Action performed

Full review finished.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/dhcp/tests/common/mod.rs`:
- Around line 22-55: Remove the broad dead_code and unused_imports suppressions
in the shared DHCP test module, including those on kea_v6, factory re-exports,
Kea types, and helper functions. Keep only helpers and re-exports with actual
parent-module callers; move target-specific helpers into the integration-test
targets that use them or gate them with an explicit test-support configuration,
while preserving clippy-clean compilation without broad allows.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d2b53461-0e0f-4a16-b779-f3a2868580ff

📥 Commits

Reviewing files that changed from the base of the PR and between 4f0e11f and c7c6f42.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (43)

• crates/dhcp-server/src/cache.rs
• crates/dhcp-server/src/command_line.rs
• crates/dhcp-server/src/grpc_server.rs
• crates/dhcp-server/src/main.rs
• crates/dhcp-server/src/metrics.rs
• crates/dhcp-server/src/modes/controller.rs
• crates/dhcp-server/src/modes/dpu.rs
• crates/dhcp-server/src/modes/mod.rs
• crates/dhcp-server/src/packet_handler.rs
• crates/dhcp-server/src/rpc/client.rs
• crates/dhcp-server/src/rpc/mod.rs
• crates/dhcp-server/src/util.rs
• crates/dhcp/Cargo.toml
• crates/dhcp/src/cache.rs
• crates/dhcp/src/discovery.rs
• crates/dhcp/src/discovery_v6.rs
• crates/dhcp/src/kea/ffi.rs
• crates/dhcp/src/kea_logger.rs
• crates/dhcp/src/lib.rs
• crates/dhcp/src/machine.rs
• crates/dhcp/src/machine_v6.rs
• crates/dhcp/src/metrics.rs
• crates/dhcp/src/mock_api_server.rs
• crates/dhcp/src/tls.rs
• crates/dhcp/tests/common/dhcp_factory.rs
• crates/dhcp/tests/common/dhcpv6_factory.rs
• crates/dhcp/tests/common/kea.rs
• crates/dhcp/tests/common/kea_v6.rs
• crates/dhcp/tests/common/mod.rs
• crates/pxe/src/common.rs
• crates/pxe/src/config.rs
• crates/pxe/src/extractors/machine_architecture.rs
• crates/pxe/src/extractors/mod.rs
• crates/pxe/src/main.rs
• crates/pxe/src/metrics.rs
• crates/pxe/src/middleware/metrics.rs
• crates/pxe/src/middleware/mod.rs
• crates/pxe/src/routes/cloud_init.rs
• crates/pxe/src/routes/ipxe.rs
• crates/pxe/src/routes/metrics.rs
• crates/pxe/src/routes/mod.rs
• crates/pxe/src/routes/tls.rs
• crates/pxe/src/rpc_error.rs