fix(network): wire correct IPs throughout and add cutover plan

variables.nix:
- HA server LAN IPs: .200/.201/.202 → .228/.227/.229 (from ip-addressing.md)
- Add haServer1StorageIp (.228), haServer2StorageIp (.227) for 192.168.4.0/29
- Add haStorageCidr for firewall rules

ha-server host.nix (both nodes):
- Add ens19 interface on storage subnet (/29)
- Fix defaultGateway: 192.168.2.1 → 192.168.2.254
- Fix nameservers: 192.168.2.1/8.8.8.8 → domainControllerIp (.253)

cluster-config.nix:
- DRBD replication addresses: LAN IPs → storage IPs (keep replication off LAN)
- Corosync ring_addrs: LAN IPs → storage IPs
- Firewall: add haStorageCidr to allowed sources

docs/network-cutover.md: step-by-step cutover plan with rollback at every stage

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

hosts/ha-server-2/host.nix

@@ -15,8 +15,12 @@
       address = vars.haServer2Ip;
       prefixLength = 24;
     }];
-    defaultGateway = "192.168.2.1";
-    nameservers = [ "192.168.2.1" "8.8.8.8" ];
+    interfaces.ens19.ipv4.addresses = [{
+      address = vars.haServer2StorageIp;
+      prefixLength = 29;
+    }];
+    defaultGateway = "192.168.2.254";
+    nameservers = [ vars.domainControllerIp ];
   };
 
   # Set KEY after pairing this host with the beszel hub; the token is sops-managed.