feat(ha): add vmbr2 storage-client network and corosync ring1

Infrastructure changes already applied to pve1:
- vmbr2 internal bridge created (192.168.5.0/24, no physical uplink)
- VM 200 (ha-server-1): net2 added → vmbr2 (ens20)
- VM 201 (ha-server-2): net2 added → vmbr2 (ens20)
- CT 105 (docker): net1 added → vmbr2 (eth1)
- VM 101 (server): net1 added → vmbr2 (ens19) — needs reboot to activate

NixOS config (deploy to ha nodes to complete; docker/server at cutover):
- ha-server-{1,2}/host.nix: ens20 with 192.168.5.{228,227}/24
- docker/host.nix: eth1 with 192.168.5.225/24
- server/host.nix: ens19 with 192.168.5.226/24
- cluster-config.nix: corosync ring1 on LAN IPs as backup heartbeat path
- cluster-config.nix: allow haClientCidr (192.168.5.0/24) in iptables
- ha-server.nix: NFS exports now allow both lanCidr and haClientCidr
- VIP moves from 192.168.2.229 (vmbr0/LAN) to 192.168.5.229 (vmbr2)
- iSCSI portal to be rebound from [::0] to 192.168.5.229 at cutover

variables.nix: haStorageCidr corrected to 192.168.4.224/29; new vars:
vmStorageClientInterface, lxcStorageInterface, haServer{1,2}ClientIp,
dockerStorageIp, serverStorageIp, haClientCidr/PrefixLength; haServerVip
updated to 192.168.5.229.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/ha/acceptance-tests.sh

@@ -12,7 +12,7 @@ NODE1="${NODE1:-ha-server-1}"
 NODE2="${NODE2:-ha-server-2}"
 NODE1_IP="${NODE1_IP:-192.168.2.228}"   # vars.haServer1Ip
 NODE2_IP="${NODE2_IP:-192.168.2.227}"   # vars.haServer2Ip
-VIP="${VIP:-192.168.2.229}"             # vars.haServerVip
+VIP="${VIP:-192.168.5.229}"             # vars.haServerVip
 XFS_MOUNT="${XFS_MOUNT:-/srv/ha-data}"  # vars.haStorageRoot
 ISCSI_IQN="${ISCSI_IQN:-iqn.2026-01.home.sweet:ha-storage}"  # vars.haIscsiIqn
 # ──────────────────────────────────────────────────────────────────────────

scripts/ha/cluster-init.sh

@@ -26,7 +26,7 @@ NODE1="${NODE1:-ha-server-1}"
 NODE2="${NODE2:-ha-server-2}"
 NODE1_IP="${NODE1_IP:-192.168.2.228}"   # vars.haServer1Ip
 NODE2_IP="${NODE2_IP:-192.168.2.227}"   # vars.haServer2Ip
-VIP="${VIP:-192.168.2.229}"             # vars.haServerVip
+VIP="${VIP:-192.168.5.229}"             # vars.haServerVip
 XFS_MOUNT="${XFS_MOUNT:-/srv/ha-data}"  # vars.haStorageRoot
 ISCSI_IQN="${ISCSI_IQN:-iqn.2026-01.home.sweet:ha-storage}"  # vars.haIscsiIqn
 ISCSI_LUN_FILE="${XFS_MOUNT}/iscsi-lun.img"
@@ -418,7 +418,7 @@ cibadmin --replace --scope resources --xml-text '<resources>
     </primitive>
     <primitive id="vip" class="ocf" type="IPaddr2" provider="heartbeat">
       <instance_attributes id="vip-attrs">
-        <nvpair id="vip-ip" name="ip" value="192.168.2.229"/>
+        <nvpair id="vip-ip" name="ip" value="192.168.5.229"/>
         <nvpair id="vip-cidr" name="cidr_netmask" value="24"/>
       </instance_attributes>
       <operations>

scripts/ha/deploy.sh

@@ -452,7 +452,7 @@ if ! $SKIP_CLUSTER_INIT; then
     ssh -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no "${HA_USER}@${NODE1_IP}" \
       "sudo env NODE1=${NODE1_HOST} NODE2=${NODE2_HOST} \
        NODE1_IP=${NODE1_IP} NODE2_IP=${NODE2_IP} \
-       VIP=192.168.2.229 XFS_MOUNT=/srv/ha-data \
+       VIP=192.168.5.229 XFS_MOUNT=/srv/ha-data \
        ISCSI_IQN=iqn.2026-01.home.sweet:ha-storage \
        VMID_NODE1=${VMID1} VMID_NODE2=${VMID2} \
        HA_USER=${HA_USER} HA_KEY=/root/.ssh/cluster-init-key \
@@ -491,7 +491,7 @@ if ! $SKIP_TESTS; then
   else
     NODE1="$NODE1_HOST" NODE2="$NODE2_HOST" \
     NODE1_IP="$NODE1_IP" NODE2_IP="$NODE2_IP" \
-    VIP="192.168.2.229" \
+    VIP="192.168.5.229" \
     bash "${REPO_ROOT}/scripts/ha/acceptance-tests.sh"
   fi
 fi

scripts/ha/failover.sh

@@ -19,7 +19,7 @@ NODE1="${NODE1:-ha-server-1}"
 NODE2="${NODE2:-ha-server-2}"
 NODE1_IP="${NODE1_IP:-192.168.2.228}"
 NODE2_IP="${NODE2_IP:-192.168.2.227}"
-VIP="${VIP:-192.168.2.229}"
+VIP="${VIP:-192.168.5.229}"
 XFS_MOUNT="${XFS_MOUNT:-/srv/ha-data}"
 HA_USER="${HA_USER:-nixos}"
 # ──────────────────────────────────────────────────────────────────────────

scripts/ha/health.sh

@@ -11,7 +11,7 @@ NODE1="${NODE1:-ha-server-1}"
 NODE2="${NODE2:-ha-server-2}"
 NODE1_IP="${NODE1_IP:-192.168.2.228}"   # vars.haServer1Ip
 NODE2_IP="${NODE2_IP:-192.168.2.227}"   # vars.haServer2Ip
-VIP="${VIP:-192.168.2.229}"             # vars.haServerVip
+VIP="${VIP:-192.168.5.229}"             # vars.haServerVip
 XFS_MOUNT="${XFS_MOUNT:-/srv/ha-data}"  # vars.haStorageRoot
 HA_USER="${HA_USER:-nixos}"
 # ──────────────────────────────────────────────────────────────────────────