feat(ha): add vmbr2 storage-client network and corosync ring1

Infrastructure changes already applied to pve1:
- vmbr2 internal bridge created (192.168.5.0/24, no physical uplink)
- VM 200 (ha-server-1): net2 added → vmbr2 (ens20)
- VM 201 (ha-server-2): net2 added → vmbr2 (ens20)
- CT 105 (docker): net1 added → vmbr2 (eth1)
- VM 101 (server): net1 added → vmbr2 (ens19) — needs reboot to activate

NixOS config (deploy to ha nodes to complete; docker/server at cutover):
- ha-server-{1,2}/host.nix: ens20 with 192.168.5.{228,227}/24
- docker/host.nix: eth1 with 192.168.5.225/24
- server/host.nix: ens19 with 192.168.5.226/24
- cluster-config.nix: corosync ring1 on LAN IPs as backup heartbeat path
- cluster-config.nix: allow haClientCidr (192.168.5.0/24) in iptables
- ha-server.nix: NFS exports now allow both lanCidr and haClientCidr
- VIP moves from 192.168.2.229 (vmbr0/LAN) to 192.168.5.229 (vmbr2)
- iSCSI portal to be rebound from [::0] to 192.168.5.229 at cutover

variables.nix: haStorageCidr corrected to 192.168.4.224/29; new vars:
vmStorageClientInterface, lxcStorageInterface, haServer{1,2}ClientIp,
dockerStorageIp, serverStorageIp, haClientCidr/PrefixLength; haServerVip
updated to 192.168.5.229.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

variables.nix

@@ -7,8 +7,10 @@
   lanGateway = "192.168.2.254"; # LAN default gateway (router)
   lanPrefixLength = 24; # LAN subnet prefix length (/24 = 255.255.255.0)
   lxcLanInterface = "eth0"; # LAN NIC name in LXC containers (set by Proxmox --net0 name=eth0)
+  lxcStorageInterface = "eth1"; # storage-client NIC name in LXC containers (vmbr2, --net1)
   vmLanInterface = "ens18"; # LAN NIC name in Proxmox VMs (virtio, first NIC)
-  vmStorageInterface = "ens19"; # storage NIC name in HA server VMs (virtio, second NIC on vmbr1)
+  vmStorageInterface = "ens19"; # cluster-internal NIC in HA VMs (vmbr1 — DRBD + Corosync only)
+  vmStorageClientInterface = "ens20"; # storage-client NIC in HA VMs (vmbr2 — iSCSI/NFS VIP)
   pxeServerIp = "192.168.2.223"; # pxe-boot LXC container LAN IP
   nixCacheIp = "192.168.2.224"; # nix-cache LXC container LAN IP
   tailscaleRouterIp = "192.168.2.222"; # tailscale-router LXC container LAN IP
@@ -100,20 +102,28 @@
   dockerAccessGid = 50010;
 
   # HA file server cluster
-  # LAN IPs (vmbr0 / ens18) — client-facing: iSCSI initiators, NFS, management.
-  # Storage IPs (vmbr1 / ens19) — isolated internal bridge, used for DRBD
-  # replication and Corosync heartbeat only; never leaves pve1.
-  # haServerVip: floating virtual IP managed by Pacemaker's IPaddr2 resource;
-  # NFS and iSCSI clients connect here regardless of which node is Active.
+  # LAN IPs (vmbr0 / ens18) — management only after storage migration.
+  # Cluster IPs (vmbr1 / ens19) — isolated internal bridge, DRBD replication
+  # and Corosync heartbeat only; never leaves pve1.
+  # Storage-client IPs (vmbr2 / ens20) — isolated internal bridge for iSCSI
+  # and NFS; docker and server VMs connect here instead of crossing vmbr0.
+  # haServerVip: floating virtual IP on vmbr2, managed by Pacemaker IPaddr2;
+  # all iSCSI and NFS clients connect here regardless of which node is Active.
   haServer1Host = "ha-server-1";
   haServer2Host = "ha-server-2";
-  haServer1Ip = "192.168.2.228"; # LAN IP, node 1
-  haServer2Ip = "192.168.2.227"; # LAN IP, node 2
-  haServerVip = "192.168.2.229"; # floating VIP (Pacemaker IPaddr2)
-  haServer1StorageIp = "192.168.4.228"; # storage-net IP, node 1 (vmbr1 / ens19)
-  haServer2StorageIp = "192.168.4.227"; # storage-net IP, node 2 (vmbr1 / ens19)
-  haStorageCidr = "192.168.4.0/29"; # storage subnet — internal to pve1 only
-  haStoragePrefixLength = 29; # storage subnet prefix length (/29)
+  haServer1Ip = "192.168.2.228"; # LAN IP, node 1 (vmbr0 / ens18)
+  haServer2Ip = "192.168.2.227"; # LAN IP, node 2 (vmbr0 / ens18)
+  haServer1StorageIp = "192.168.4.228"; # cluster-net IP, node 1 (vmbr1 / ens19)
+  haServer2StorageIp = "192.168.4.227"; # cluster-net IP, node 2 (vmbr1 / ens19)
+  haStorageCidr = "192.168.4.224/29"; # cluster subnet — internal to pve1 only
+  haStoragePrefixLength = 29; # cluster subnet prefix length (/29)
+  haServer1ClientIp = "192.168.5.228"; # storage-client IP, node 1 (vmbr2 / ens20)
+  haServer2ClientIp = "192.168.5.227"; # storage-client IP, node 2 (vmbr2 / ens20)
+  haServerVip = "192.168.5.229"; # floating VIP on vmbr2 (Pacemaker IPaddr2)
+  dockerStorageIp = "192.168.5.225"; # docker CT storage-client IP (vmbr2 / eth1)
+  serverStorageIp = "192.168.5.226"; # server VM storage-client IP (vmbr2 / ens19)
+  haClientCidr = "192.168.5.0/24"; # storage-client subnet — internal to pve1 only
+  haClientPrefixLength = 24; # storage-client subnet prefix length (/24)
   haStorageRoot = "/srv/ha-data"; # XFS-over-DRBD mount point on the Active node
   haIscsiIqn = "iqn.2026-01.home.sweet:ha-storage";
   # DRBD backing disk — identified by SCSI controller path so it resolves to the