refactor(ha): renumber cluster→VLAN10, storage→VLAN20; iSCSI/NFS protocol separation

Renumber internal HA bridges so VLAN ID matches IP third octet:
  vmbr1 (cluster): 192.168.4.x → 192.168.10.x (VLAN 10, /29)
  vmbr2 (storage): 192.168.5.x → 192.168.20.x (VLAN 20, /24)

Enforce protocol separation at the firewall on both HA nodes:
  - iSCSI (3260/tcp): storage-client subnet (192.168.20.0/24) only
  - NFS (111,2049,20048 tcp+udp): LAN subnet (192.168.2.0/24) only
  - Cluster subnet (192.168.10.224/29) accepted wholesale (DRBD+Corosync)
Moves from allowedTCPPorts/allowedUDPPorts to source-restricted extraCommands
rules on the nixos-fw chain.

NFS exports reduced to LAN-only (drop haClientCidr lines from mkNfsExports).
Storage-client network clients use iSCSI only; no NFS on VLAN 20.

All HA script VIP/storage IP defaults updated to match.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J8djTWdXVzXZc99iujU6T2

scripts/ha/deploy.sh

@@ -84,9 +84,9 @@ NODE1_HOST="ha-server-1"
 NODE2_HOST="ha-server-2"
 NODE1_IP="192.168.2.228"
 NODE2_IP="192.168.2.227"
-STORAGE_IP1="192.168.4.228"
-STORAGE_IP2="192.168.4.227"
-STORAGE_CIDR="192.168.4.0/29"
+STORAGE_IP1="192.168.10.228"
+STORAGE_IP2="192.168.10.227"
+STORAGE_CIDR="192.168.10.224/29"
 SSH_USER="${PROXMOX_SSH_USER:-wayne}"
 
 # ── Argument parsing ──────────────────────────────────────────────────────────
@@ -452,7 +452,7 @@ if ! $SKIP_CLUSTER_INIT; then
     ssh -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no "${HA_USER}@${NODE1_IP}" \
       "sudo env NODE1=${NODE1_HOST} NODE2=${NODE2_HOST} \
        NODE1_IP=${NODE1_IP} NODE2_IP=${NODE2_IP} \
-       VIP=192.168.5.229 XFS_MOUNT=/srv/ha-data \
+       VIP=192.168.20.229 XFS_MOUNT=/srv/ha-data \
        ISCSI_IQN=iqn.2026-01.home.sweet:ha-storage \
        VMID_NODE1=${VMID1} VMID_NODE2=${VMID2} \
        HA_USER=${HA_USER} HA_KEY=/root/.ssh/cluster-init-key \
@@ -491,7 +491,7 @@ if ! $SKIP_TESTS; then
   else
     NODE1="$NODE1_HOST" NODE2="$NODE2_HOST" \
     NODE1_IP="$NODE1_IP" NODE2_IP="$NODE2_IP" \
-    VIP="192.168.5.229" \
+    VIP="192.168.20.229" \
     bash "${REPO_ROOT}/scripts/ha/acceptance-tests.sh"
   fi
 fi