fix(ha): add xfsprogs to system packages; fix cluster-init PATH and DRBD check

- ha-server.nix: add xfsprogs to systemPackages so mkfs.xfs is on PATH for
  root (needed by cluster-init.sh during initial setup)
- cluster-config.nix: create /var/lib/drbd via tmpfiles to silence
  lk_bdev_save warnings from drbd-utils
- cluster-init.sh: dynamically find xfsprogs in /nix/store if not on PATH
  (fallback for running VMs before xfsprogs is in the system profile)
- cluster-init.sh: fix DRBD metadata check on node2 — broken regex now uses
  grep -E for ERE alternation to correctly skip create-md when DRBD is already
  set up (previous regex would have triggered create-md on a live secondary)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HaH1cSGvhogRP5ExoF6nD8

modules/build-types/ha-server.nix

@@ -14,7 +14,7 @@
 #   the Beszel hub) is not set yet — add it to hosts/ha-server-{1,2}/host.nix
 #   under services.beszel.agent.environment.KEY once the hub accepts the
 #   new agents, following the pattern in hosts/server/host.nix.
-{ lib, vars, ... }:
+{ lib, pkgs, vars, ... }:
 
 let
   # Generates /etc/exports lines for all nfsShares data entries. Shared
@@ -33,6 +33,10 @@ in
     ../beszel/enable-agent.nix
   ];
 
+  # xfsprogs must be in systemPackages so mkfs.xfs/xfs_info are on PATH
+  # for cluster-init.sh (which runs as root via sudo during initial cluster setup).
+  environment.systemPackages = [ pkgs.xfsprogs ];
+
   services.nfs.server = {
     enable = true;
     exports = mkNfsExports vars.haStorageRoot;

modules/ha/cluster-config.nix

@@ -30,6 +30,9 @@
   # cluster management commands (drbdadm, crm*, pcs, etc.)
   security.sudo.wheelNeedsPassword = lib.mkForce false;
 
+  # DRBD lock-file directory (drbd-utils checks for it; missing → harmless but noisy warnings).
+  systemd.tmpfiles.rules = [ "d /var/lib/drbd 0750 root root -" ];
+
   services.drbd = {
     enable = true;
     config = ''