feat(pxe-boot): switch NFS mount to HA cluster LAN VIP

Updates mount-pxe-images.nix to mount pxe-boot/images from
ha-vip-lan.sweet.home (Pacemaker vip-lan, 192.168.2.229) instead of
server.sweet.home. Storage root changes from /tank to haStorageRoot
(/srv/ha-data). NFSv3+nolock options for LXC are unchanged.

Removes nfsServerHost and storageRoot from variables.nix — all NFS
clients now reference the HA cluster directly (docker via haStorageNfsFqdn
on VLAN 20, pxe-boot via ha-vip-lan on VLAN 2). Updates the nfsShares
comment to reflect the new single-source-of-truth role without the
dead server.nix references.

DNS records for server.sweet.home and server.storage.home were already
cleaned up automatically by IPA dynamic DNS when the VM was deleted.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J8djTWdXVzXZc99iujU6T2

modules/pxe-boot/mount-pxe-images.nix

@@ -1,14 +1,14 @@
 { config, lib, vars, ... }:
 
 let
-  # Use the same FQDN approach as docker/mount-data.nix — a bare hostname is
-  # unreliable: systemd-resolved only tries LLMNR for single-label names, and
-  # a global search domain causes it to skip the interface-scoped LAN DNS.
-  nfsServer = "${vars.nfsServerHost}.${vars.homeDomain}";
+  # FQDN of the LAN NFS VIP (Pacemaker vip-lan, 192.168.2.229). Using the
+  # FQDN rather than a raw IP or bare hostname avoids systemd-resolved LLMNR
+  # quirks and survives a future VIP renumber via a DNS-only update.
+  nfsServer = "ha-vip-lan.${vars.homeDomain}";
 in
 {
   fileSystems.${vars.nfsShares.pxebootImages.mountpoint} = {
-    device = "${nfsServer}:${vars.storageRoot}/${vars.nfsShares.pxebootImages.subpath}";
+    device = "${nfsServer}:${vars.haStorageRoot}/${vars.nfsShares.pxebootImages.subpath}";
     fsType = "nfs";
     options = [
       "_netdev"