refactor(ha): renumber cluster→VLAN10, storage→VLAN20; iSCSI/NFS protocol separation

Renumber internal HA bridges so VLAN ID matches IP third octet:
  vmbr1 (cluster): 192.168.4.x → 192.168.10.x (VLAN 10, /29)
  vmbr2 (storage): 192.168.5.x → 192.168.20.x (VLAN 20, /24)

Enforce protocol separation at the firewall on both HA nodes:
  - iSCSI (3260/tcp): storage-client subnet (192.168.20.0/24) only
  - NFS (111,2049,20048 tcp+udp): LAN subnet (192.168.2.0/24) only
  - Cluster subnet (192.168.10.224/29) accepted wholesale (DRBD+Corosync)
Moves from allowedTCPPorts/allowedUDPPorts to source-restricted extraCommands
rules on the nixos-fw chain.

NFS exports reduced to LAN-only (drop haClientCidr lines from mkNfsExports).
Storage-client network clients use iSCSI only; no NFS on VLAN 20.

All HA script VIP/storage IP defaults updated to match.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J8djTWdXVzXZc99iujU6T2

scripts/ha/cluster-init.sh

@@ -26,7 +26,7 @@ NODE1="${NODE1:-ha-server-1}"
 NODE2="${NODE2:-ha-server-2}"
 NODE1_IP="${NODE1_IP:-192.168.2.228}"   # vars.haServer1Ip
 NODE2_IP="${NODE2_IP:-192.168.2.227}"   # vars.haServer2Ip
-VIP="${VIP:-192.168.5.229}"             # vars.haServerVip (storage-client, vmbr2)
+VIP="${VIP:-192.168.20.229}"            # vars.haServerVip (storage-client, vmbr2, VLAN 20)
 VIP_LAN="${VIP_LAN:-192.168.2.229}"    # vars.haServerLanVip (LAN, vmbr0)
 XFS_MOUNT="${XFS_MOUNT:-/srv/ha-data}"  # vars.haStorageRoot
 ISCSI_IQN="${ISCSI_IQN:-iqn.2026-01.home.sweet:ha-storage}"  # vars.haIscsiIqn
@@ -419,7 +419,7 @@ cibadmin --replace --scope resources --xml-text '<resources>
     </primitive>
     <primitive id="vip-storage" class="ocf" type="IPaddr2" provider="heartbeat">
       <instance_attributes id="vip-storage-attrs">
-        <nvpair id="vip-storage-ip" name="ip" value="192.168.5.229"/>
+        <nvpair id="vip-storage-ip" name="ip" value="192.168.20.229"/>
         <nvpair id="vip-storage-cidr" name="cidr_netmask" value="24"/>
         <nvpair id="vip-storage-nic" name="nic" value="ens20"/>
       </instance_attributes>