feat(ha): add vmbr2 storage-client network and corosync ring1

Infrastructure changes already applied to pve1:
- vmbr2 internal bridge created (192.168.5.0/24, no physical uplink)
- VM 200 (ha-server-1): net2 added → vmbr2 (ens20)
- VM 201 (ha-server-2): net2 added → vmbr2 (ens20)
- CT 105 (docker): net1 added → vmbr2 (eth1)
- VM 101 (server): net1 added → vmbr2 (ens19) — needs reboot to activate

NixOS config (deploy to ha nodes to complete; docker/server at cutover):
- ha-server-{1,2}/host.nix: ens20 with 192.168.5.{228,227}/24
- docker/host.nix: eth1 with 192.168.5.225/24
- server/host.nix: ens19 with 192.168.5.226/24
- cluster-config.nix: corosync ring1 on LAN IPs as backup heartbeat path
- cluster-config.nix: allow haClientCidr (192.168.5.0/24) in iptables
- ha-server.nix: NFS exports now allow both lanCidr and haClientCidr
- VIP moves from 192.168.2.229 (vmbr0/LAN) to 192.168.5.229 (vmbr2)
- iSCSI portal to be rebound from [::0] to 192.168.5.229 at cutover

variables.nix: haStorageCidr corrected to 192.168.4.224/29; new vars:
vmStorageClientInterface, lxcStorageInterface, haServer{1,2}ClientIp,
dockerStorageIp, serverStorageIp, haClientCidr/PrefixLength; haServerVip
updated to 192.168.5.229.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/ha/cluster-init.sh

@@ -26,7 +26,7 @@ NODE1="${NODE1:-ha-server-1}"
 NODE2="${NODE2:-ha-server-2}"
 NODE1_IP="${NODE1_IP:-192.168.2.228}"   # vars.haServer1Ip
 NODE2_IP="${NODE2_IP:-192.168.2.227}"   # vars.haServer2Ip
-VIP="${VIP:-192.168.2.229}"             # vars.haServerVip
+VIP="${VIP:-192.168.5.229}"             # vars.haServerVip
 XFS_MOUNT="${XFS_MOUNT:-/srv/ha-data}"  # vars.haStorageRoot
 ISCSI_IQN="${ISCSI_IQN:-iqn.2026-01.home.sweet:ha-storage}"  # vars.haIscsiIqn
 ISCSI_LUN_FILE="${XFS_MOUNT}/iscsi-lun.img"
@@ -418,7 +418,7 @@ cibadmin --replace --scope resources --xml-text '<resources>
     </primitive>
     <primitive id="vip" class="ocf" type="IPaddr2" provider="heartbeat">
       <instance_attributes id="vip-attrs">
-        <nvpair id="vip-ip" name="ip" value="192.168.2.229"/>
+        <nvpair id="vip-ip" name="ip" value="192.168.5.229"/>
         <nvpair id="vip-cidr" name="cidr_netmask" value="24"/>
       </instance_attributes>
       <operations>