fix(network): wire correct IPs throughout and add cutover plan

variables.nix:
- HA server LAN IPs: .200/.201/.202 → .228/.227/.229 (from ip-addressing.md)
- Add haServer1StorageIp (.228), haServer2StorageIp (.227) for 192.168.4.0/29
- Add haStorageCidr for firewall rules

ha-server host.nix (both nodes):
- Add ens19 interface on storage subnet (/29)
- Fix defaultGateway: 192.168.2.1 → 192.168.2.254
- Fix nameservers: 192.168.2.1/8.8.8.8 → domainControllerIp (.253)

cluster-config.nix:
- DRBD replication addresses: LAN IPs → storage IPs (keep replication off LAN)
- Corosync ring_addrs: LAN IPs → storage IPs
- Firewall: add haStorageCidr to allowed sources

docs/network-cutover.md: step-by-step cutover plan with rollback at every stage

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/ha/cluster-config.nix

@@ -47,11 +47,11 @@
         }
 
         on ${vars.haServer1Host} {
-          address ${vars.haServer1Ip}:${toString vars.ports.haServerDrbd};
+          address ${vars.haServer1StorageIp}:${toString vars.ports.haServerDrbd};
         }
 
         on ${vars.haServer2Host} {
-          address ${vars.haServer2Ip}:${toString vars.ports.haServerDrbd};
+          address ${vars.haServer2StorageIp}:${toString vars.ports.haServerDrbd};
         }
       }
     '';
@@ -75,8 +75,8 @@
   services.corosync = {
     clusterName = "ha-cluster";
     nodelist = [
-      { nodeid = 1; name = vars.haServer1Host; ring_addrs = [ vars.haServer1Ip ]; }
-      { nodeid = 2; name = vars.haServer2Host; ring_addrs = [ vars.haServer2Ip ]; }
+      { nodeid = 1; name = vars.haServer1Host; ring_addrs = [ vars.haServer1StorageIp ]; }
+      { nodeid = 2; name = vars.haServer2Host; ring_addrs = [ vars.haServer2StorageIp ]; }
     ];
   };
 
@@ -101,6 +101,7 @@
     extraCommands = ''
       iptables -A INPUT -s ${vars.haServer1Ip}/32 -j ACCEPT
       iptables -A INPUT -s ${vars.haServer2Ip}/32 -j ACCEPT
+      iptables -A INPUT -s ${vars.haStorageCidr} -j ACCEPT
     '';
   };
 }