docs(ha): update docs to reflect implemented network segmentation

ip-addressing.md:
  - Storage-client network purpose updated: NFS primary, iSCSI available
  - Protocol separation box updated: NFS on both VIPs (each CIDR-restricted);
    iSCSI on VLAN 20 only but not in active use
  - docker role updated to NFS client (not iSCSI initiator)
  - vip-storage description updated to NFS + iSCSI endpoint

ha-network-audit.md:
  - Implementation status header added noting all audit items resolved
  - Records decisions that diverged from original recommendations
    (VLAN renumbering, dual VIP, NFS-over-iSCSI for docker/swarm)
  - Notes deferred items (STONITH, iSCSI ACLs)

network-cutover.md:
  - New Stage 6: HA storage cutover — docker NFS remount from
    server.sweet.home to vip-storage (192.168.20.229), final rsync
    steps, and server.sweet.home decommission procedure
  - Former Stage 6 (final cleanup) renumbered to Stage 7

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J8djTWdXVzXZc99iujU6T2

docs/network-cutover.md

@@ -336,7 +336,85 @@ temporarily use either.
 
 ---
 
-## Stage 6 — Final cleanup
+## Stage 6 — HA storage cutover (docker NFS remount)
+
+> **Prerequisite:** HA cluster fully deployed and `vip-storage` (192.168.20.229) serving
+> NFS. docker CT must have eth1 on vmbr2 (already done). Final rsync from server.sweet.home
+> to `/srv/ha-data` must be complete before this stage.
+
+docker.sweet.home currently NFS-mounts its persistent volumes from `server.sweet.home`
+(`192.168.2.226:/tank/docker/...`). This stage moves those mounts to the HA cluster's
+storage VIP so server can be decommissioned.
+
+### 6a. Final rsync from server to HA cluster
+
+Run from server.sweet.home (or over SSH from the workstation) to sync any data written
+since the initial rsync:
+
+```bash
+# Confirm active HA node and mount point
+ssh wayne@192.168.2.228 'sudo findmnt /srv/ha-data'  # check which node is active
+
+# rsync each dataset (adjust source paths to match /tank layout on server)
+sudo rsync -av --delete /tank/docker/config/    wayne@<active-node-ip>:/srv/ha-data/docker/config/
+sudo rsync -av --delete /tank/docker/databases/ wayne@<active-node-ip>:/srv/ha-data/docker/databases/
+sudo rsync -av --delete /tank/docker/volumes/   wayne@<active-node-ip>:/srv/ha-data/docker/volumes/
+sudo rsync -av --delete /tank/docker/nextcloud-data/ wayne@<active-node-ip>:/srv/ha-data/docker/nextcloud-data/
+```
+
+### 6b. Update docker NixOS config to mount from vip-storage
+
+In `hosts/docker/host.nix` (or wherever the NFS mount fileSystems are declared), change
+the NFS server from `server.sweet.home` / `192.168.2.226` to `192.168.20.229`:
+
+```nix
+# Before:
+fileSystems."/mnt/docker/config" = {
+  device = "server:/tank/docker/config";   # or 192.168.2.226:...
+  ...
+};
+
+# After:
+fileSystems."/mnt/docker/config" = {
+  device = "192.168.20.229:/srv/ha-data/docker/config";
+  ...
+};
+```
+
+Repeat for all four docker shares (`config`, `databases`, `volumes`, `nextcloud-data`).
+Then rebuild docker:
+
+```bash
+# On the workstation — or via Switch-nix on docker itself
+sudo nixos-rebuild switch --no-write-lock-file --refresh \
+  --flake "git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#lxc-docker"
+```
+
+### 6c. Verify mounts and container health
+
+```bash
+ssh wayne@192.168.2.225 'findmnt | grep 192.168.20'   # mounts should show vip-storage
+ssh wayne@192.168.2.225 'docker ps'                    # all containers running
+```
+
+Spot-check Nextcloud, Traefik, and any database containers for connectivity.
+
+### 6d. Decommission server.sweet.home
+
+Once docker is confirmed healthy on the HA NFS mounts:
+
+```bash
+# Stop server VM on pve1
+ssh wayne@192.168.2.245 'sudo qm stop 101'
+
+# (Optional) Archive the ZFS pool snapshot before destroying
+# Then after a settling period:
+ssh wayne@192.168.2.245 'sudo qm destroy 101 --destroy-unreferenced-disks 1'
+```
+
+---
+
+## Stage 7 — Final cleanup
 
 Once all hosts are at their new IPs and verified: