Add Docker Swarm HA cluster: ha-docker-1 and ha-docker-2

Two new NixOS Proxmox VMs (VMIDs 202/203) forming a dual-manager Docker
Swarm on dedicated vmbr3 (192.168.30.0/24, VLAN 30) for gossip and VXLAN,
with NFS via the storage-client network (vmbr2) from the existing HA cluster.

- nixos/variables.nix: add ha-docker IP/interface/port vars and swarm CIDR
- nixos/modules/build-types/ha-docker.nix: new build type — Docker 29,
  NFS mounts, beszel-agent, health monitoring, swarm firewall rules with
  checkReversePath = "loose" for VXLAN routing mesh
- nixos/hosts/ha-docker-{1,2}/host.nix: per-host identity — three NICs
  (LAN, storage, swarm), IPA dyndns pinned to LAN interface
- nixos/flake.nix: add proxmox-ha-docker-{1,2} targets; build-validated
  with nix build --dry-run (169 derivations, no errors)
- nixos/docs/ip-addressing.md: document VLAN 30 / swarm.home zone,
  ha-docker IP allocations across all three subnets
- nixos/scripts/docker-swarm/deploy.sh: 10-phase lifecycle script
  (bridge, keys, IPA, VMs, swarm init, DNS, verify); modelled on
  scripts/ha/deploy.sh with --destroy mode
- nixos/docs/internal/docker-swarm-cutover.md: service-by-service
  migration guide covering Traefik log rotation, Nextcloud cron sidecar,
  docker-health-to-gotify swarm awareness updates, Passbolt/Gitea steps,
  DNS cutover, and CT 105 decommission checklist

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DASH15okNvWeY1rVJmyJoJ

hosts/ha-docker-2/host.nix

@@ -0,0 +1,32 @@
+{ vars, ... }:
+{
+  networking = {
+    hostName = vars.haDocker2Host;
+    hostId   = "a2d0c4e2";
+    useDHCP  = false;
+    interfaces = {
+      # ens18 — LAN management NIC (vmbr0, 192.168.2.0/24)
+      ${vars.vmLanInterface}.ipv4.addresses = [{
+        address      = vars.haDocker2Ip;
+        prefixLength = vars.lanPrefixLength;
+      }];
+      # ens19 — storage-client NIC (vmbr2, 192.168.20.0/24) — NFS from HA cluster
+      ${vars.haDockerStorageInterface}.ipv4.addresses = [{
+        address      = vars.haDocker2StorageIp;
+        prefixLength = vars.haClientPrefixLength;
+      }];
+      # ens20 — swarm cluster NIC (vmbr3, 192.168.30.0/24) — Docker gossip + VXLAN
+      ${vars.haDockerSwarmInterface}.ipv4.addresses = [{
+        address      = vars.haDocker2SwarmIp;
+        prefixLength = vars.haDockerSwarmPrefixLength;
+      }];
+    };
+    defaultGateway = { address = vars.lanGateway; interface = vars.vmLanInterface; };
+    nameservers    = [ vars.domainControllerIp ];
+  };
+
+  # Only register the LAN IP with IPA DNS — same reasoning as ha-docker-1.
+  security.ipa.dyndns.interface = vars.vmLanInterface;
+
+  system.stateVersion = "26.05";
+}