test-lab: add two-node HA file-server test cluster config

Disposable test VMs (ha-test-node1 / ha-test-node2, VMIDs 200/201 on pve1)
to evaluate whether the DRBD + XFS + LIO + Corosync + Pacemaker stack
runs correctly on NixOS before deciding NixOS vs Debian for production.

Includes:
- test-lab/ha/disko.nix: 20G boot disk layout (smaller than production)
- test-lab/ha/common.nix: shared HA stack (drbd, corosync, pacemaker,
  targetcli-fb, xfsprogs), OCF PATH workaround for nixpkgs#207891
- test-lab/ha/node1.nix / node2.nix: per-node hostname + static IP
- test-lab/ha/fence-pve-ssh.py: Proxmox SSH fence agent for STONITH
- test-lab/ha/cluster-init.sh: one-shot cluster bootstrap script
- test-lab/ha/cluster-enable-stonith.sh: enables STONITH post-key-deploy
- flake.nix: adds ha-test-node1 / ha-test-node2 nixosConfigurations
  (bypasses mkTarget / clan-core / sops-nix — test-only)

These VMs must be destroyed once acceptance testing is complete.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

flake.nix

@@ -132,6 +132,34 @@
         lxc-tor-relay = mkTarget { platform = "lxc"; buildType = "tor-relay"; hostPath = ./hosts/tor-relay/host.nix; };
       };
 
+      # ── HA test lab VMs ─────────────────────────────────────────────────
+      # Two throwaway NixOS VMs to test the DRBD + XFS + LIO + Pacemaker
+      # stack.  Deliberately bypass mkTarget (no clan-core, no sops-nix,
+      # no home-manager) — these are disposable and must be destroyed once
+      # the acceptance tests are done.
+      # Build disk images with:
+      #   nix build .#nixosConfigurations.ha-test-node1.config.system.build.diskoImagesScript
+      # then run the script to produce ha-test-node1.raw (import with qm importdisk).
+      haTestTargets =
+        let
+          haNode = { nodeModule }: nixpkgs.lib.nixosSystem {
+            inherit system;
+            modules = [
+              inputs.disko.nixosModules.disko
+              ./modules/hardware-configuration/vm/proxmox.nix
+              ./modules/boot/efi.nix
+              ./test-lab/ha/disko.nix
+              ./test-lab/ha/common.nix
+              nodeModule
+            ];
+            specialArgs = { inherit vars; };
+          };
+        in
+        {
+          ha-test-node1 = haNode { nodeModule = ./test-lab/ha/node1.nix; };
+          ha-test-node2 = haNode { nodeModule = ./test-lab/ha/node2.nix; };
+        };
+
       # Auto-install environments (migrated from the former nix-auto-installer
       # flake): a self-contained NixOS installer that boots, discovers this
       # flake's own nixosConfigurations over the network, and runs
@@ -207,7 +235,7 @@
     in
     {
 
-      nixosConfigurations = generatedTargets // installerTargets;
+      nixosConfigurations = generatedTargets // haTestTargets // installerTargets;
 
       # Buildable auto-installer artifacts (`nix build .#<name>`). No `lxc`
       # variant (installer-boots-as-an-LXC-container) or `all` bundle