refactor(ha): renumber cluster→VLAN10, storage→VLAN20; iSCSI/NFS protocol separation

Renumber internal HA bridges so VLAN ID matches IP third octet:
  vmbr1 (cluster): 192.168.4.x → 192.168.10.x (VLAN 10, /29)
  vmbr2 (storage): 192.168.5.x → 192.168.20.x (VLAN 20, /24)

Enforce protocol separation at the firewall on both HA nodes:
  - iSCSI (3260/tcp): storage-client subnet (192.168.20.0/24) only
  - NFS (111,2049,20048 tcp+udp): LAN subnet (192.168.2.0/24) only
  - Cluster subnet (192.168.10.224/29) accepted wholesale (DRBD+Corosync)
Moves from allowedTCPPorts/allowedUDPPorts to source-restricted extraCommands
rules on the nixos-fw chain.

NFS exports reduced to LAN-only (drop haClientCidr lines from mkNfsExports).
Storage-client network clients use iSCSI only; no NFS on VLAN 20.

All HA script VIP/storage IP defaults updated to match.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J8djTWdXVzXZc99iujU6T2

modules/build-types/ha-server.nix

@@ -17,14 +17,12 @@
 { lib, pkgs, vars, ... }:
 
 let
-  # Generates /etc/exports lines for all nfsShares data entries. Each share
-  # gets two export lines — one for LAN clients (pxe-boot, proxmox host) and
-  # one for storage-client-subnet clients (docker, server via vmbr2).
+  # Generates /etc/exports lines for all nfsShares data entries.
+  # NFS is LAN-only (VLAN 2). Storage-client subnet (VLAN 20) uses iSCSI only.
   mkNfsExports = storageRoot:
     lib.concatMapStrings
       (share:
-        "  ${storageRoot}/${share.subpath} ${vars.lanCidr}${vars.nfsShares.options}\n" +
-        "  ${storageRoot}/${share.subpath} ${vars.haClientCidr}${vars.nfsShares.options}\n")
+        "  ${storageRoot}/${share.subpath} ${vars.lanCidr}${vars.nfsShares.options}\n")
       (lib.filter builtins.isAttrs (lib.attrValues vars.nfsShares));
 in
 {