feat(ha): wire sops secrets and disable NetworkManager for HA servers

- cluster-config.nix: add corosync_authkey sops binary secret
  (/etc/corosync/authkey, mode 0400) and force-disable NetworkManager
  (common config enables it; HA nodes need stable static IP networking)
- hosts/ha-server-{1,2}/host.nix: add host-token.nix import for
  sops-managed beszel-token; add KEY placeholder for beszel hub pairing
- .sops.yaml: add creation rules for secrets/ha-server-{1,2}.yaml and
  secrets/ha-corosync-authkey (admin-only until sync-host-keys.sh runs)
- secrets/ha-server-{1,2}.yaml, secrets/ha-corosync-authkey: stub files
  so eval passes before real secrets are provisioned

Bootstrap order (post-merge):
  1. bash scripts/secrets/sync-host-keys.sh proxmox-ha-server-1
  2. bash scripts/secrets/sync-host-keys.sh proxmox-ha-server-2
  3. sops updatekeys secrets/common.yaml  (grants HA nodes common secrets)
  4. sops secrets/ha-server-{1,2}.yaml   (set beszel-token values)
  5. On node1: corosync-keygen; sops -e --input-type binary
     /etc/corosync/authkey > secrets/ha-corosync-authkey; git add/commit

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HaH1cSGvhogRP5ExoF6nD8

modules/ha/cluster-config.nix

@@ -5,13 +5,10 @@
 # (hostname, static IP, stateVersion) lives in hosts/ha-server-{1,2}/host.nix.
 #
 # Corosync authkey:
-#   /etc/corosync/authkey must be present (mode 0400) for corosync to start.
-#   It is NOT managed declaratively here — the initial deploy uses
-#   scripts/ha/cluster-init.sh to generate it via corosync-keygen and
-#   distribute it to both nodes.
-#   TODO: once both hosts have their sops keys registered via
-#   scripts/secrets/sync-host-keys.sh, add a sops secret here so the
-#   authkey survives nixos-rebuild.
+#   /etc/corosync/authkey (mode 0400) is managed by sops-nix below.
+#   Bootstrap: run scripts/ha/cluster-init.sh on node1 to generate the key,
+#   then encrypt it with: sops -e --input-type binary /etc/corosync/authkey > secrets/ha-corosync-authkey
+#   Both host keys must be registered via sync-host-keys.sh first so both nodes can decrypt it.
 #
 # DRBD fencing:
 #   Production setting is resource-only: DRBD waits for the STONITH fence
@@ -20,7 +17,7 @@
 #   (see scripts/ha/cluster-enable-stonith.sh).  On a fresh cluster with
 #   no fence device yet, temporarily change to dont-care and run
 #   cluster-enable-stonith.sh once the fence key is deployed.
-{ vars, ... }:
+{ lib, vars, ... }:
 {
   services.drbd = {
     enable = true;
@@ -60,6 +57,20 @@
     '';
   };
 
+  # /etc/corosync/authkey — sops binary secret, identical on both nodes.
+  # Decryptable by both ha-server host keys (added by sync-host-keys.sh).
+  sops.secrets.corosync_authkey = {
+    sopsFile = ../../secrets/ha-corosync-authkey;
+    format = "binary";
+    path = "/etc/corosync/authkey";
+    mode = "0400";
+    restartUnits = [ "corosync.service" ];
+  };
+
+  # NixOS common config enables NetworkManager by default; HA cluster nodes
+  # need stable static IPs with predictable interface names — NM is not suitable.
+  networking.networkmanager.enable = lib.mkForce false;
+
   # services.corosync.enable is set by modules/ha/pacemaker-stack.nix.
   services.corosync = {
     clusterName = "ha-cluster";