Document pve-test's wifi-primary network and add Claude node guardrails

pve-test was briefly clustered with pve1 then deliberately de-clustered
so it could move to wifi-primary networking (4addr bridge mode, bonded
with a wired LAN backup) - a change not achievable while clustered given
corosync's latency requirements. Captures that as a reproducible script
plus docs: cluster separation procedure, the wifi network design and the
live-cutover pitfalls hit along the way, and node-role/history context.

Also adds CLAUDE.md guardrails for pve1 (production) vs pve-test
(sandbox) - this repo had none before, despite scripts here being able
to make real changes to both.

Separately: both nodes' mgmt firewalls were dropping ICMP by default
(TCP 22/8006 only), which looked like an outage mid-troubleshooting even
though SSH/web UI were fine. Added an explicit ping-allow rule to the
firewall template, applied it live on both nodes, and added an audit.sh
check so it stays enforced.

config/pve-firewall/cluster.fw.example

@@ -26,6 +26,13 @@ policy_out: ACCEPT
 IN ACCEPT -source +mgmt -p tcp -dport 8006 -log nolog
 IN ACCEPT -source +mgmt -p tcp -dport 22 -log nolog
 
+# ICMP echo (ping) from the management network - diagnostic convenience
+# only, nothing else depends on it. Without this, policy_in DROP silently
+# eats ping while SSH/web UI keep working - looks like an outage during
+# troubleshooting when the host is actually fine. See
+# docs/06-pve-test-wifi-network.md for a case this caused real confusion.
+IN ACCEPT -source +mgmt -p icmp -icmp-type echo-request -log nolog
+
 # Stage 2: Corosync (cluster quorum) - uncomment once node 2/3 join and
 # the corosync network/VLAN exists.
 # IN ACCEPT -source <COROSYNC_CIDR> -p udp -dport 5404:5405 -log nolog