refactor: full repo sweep — variables, docs, and comment cleanup

- variables.nix: switch to rec {}, extract giteaDomain/giteaRepoPath,
  extraAdminSshKeys, haLanNfsFqdn, tailscaleResolverIp, ports.dhcp,
  ports.dns; ipaServer now derives from homeDomain ref; section headers
- modules: use new vars throughout (pxe-boot, ts-dns-forwarder,
  cluster-config, configuration.nix, mount-pxe-images) — eval unchanged
- docs: delete ephemeral planning docs (AUDIT_REPORT, ha-network-audit,
  network-cutover); add docs/ha.md; drop migration reference table from
  ip-addressing.md; remove stale server example from beszel.md
- CLAUDE.md/README.md/AGENTS.md: fix build types (tailscale-router,
  ha-server, drop server); document scripts/ha/, scripts/ipa/, and
  all previously undocumented top-level and lib scripts

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs/ip-addressing.md

@@ -184,42 +184,3 @@ cannot reach either service on this VIP. The `vip-storage` endpoint is not reach
 from the workstation directly (internal bridge only); health checks proxy through the
 active HA node.
 
----
-
-## Migration reference
-
-Current → target IP for every host being renumbered.
-
-| Host | Current IP | New IP | Config location |
-|---|---|---|---|
-| router | `192.168.2.254` | `192.168.2.254` | unchanged |
-| domain-controller | `192.168.2.138` | `192.168.2.253` | `/etc/sysconfig/network-scripts/ifcfg-eth0` on guest |
-| pve1 | `192.168.2.250` | `192.168.2.245` | `/etc/network/interfaces` on Proxmox host |
-| pbs | `192.168.2.108` | `192.168.2.244` | static config on PBS host |
-| nixos workstation | `192.168.2.119` | `192.168.2.243` | `networking.interfaces` / NetworkManager on guest |
-| ha-node1 | — | `192.168.2.228` (LAN), `192.168.10.228` (cluster/VLAN 10), `192.168.20.228` (storage/VLAN 20) | active |
-| ha-node2 | — | `192.168.2.227` (LAN), `192.168.10.227` (cluster/VLAN 10), `192.168.20.227` (storage/VLAN 20) | active |
-| ha-vip-lan | — | `192.168.2.229` (vmbr0 / Pacemaker `vip-lan`) — NFS endpoint for LAN clients | active |
-| ha-vip-storage | — | `192.168.20.229` (vmbr2 / Pacemaker `vip-storage`) — iSCSI endpoint for VLAN 20 clients | active |
-| server | `192.168.2.252` | `192.168.2.226` | static config on guest |
-| docker | `192.168.2.249` | `192.168.2.225` | static config on guest |
-| nix-cache | `192.168.2.120` | `192.168.2.224` | static config on guest |
-| pxe-boot | `192.168.2.247` | `192.168.2.223` | static config on guest; update `vars.pxeServerIp` in `variables.nix` ✓ |
-| tailscale-router | `192.168.2.121` | `192.168.2.222` | static config on guest |
-| tor-relay | `192.168.2.107` | `192.168.2.221` | static config on guest |
-| pdm | `192.168.2.248` | `192.168.2.220` | static config on guest |
-
-### Cutover notes
-
-- **Do domain-controller first** — it becomes the DNS server; everything else depends on it
-  having its new IP and FreeIPA DNS configured before Pi-hole is retired.
-- **pve1 last among physical hosts** — changing the Proxmox management IP drops the web UI
-  briefly; all guests keep running.
-- **Update Pi-hole custom.list / FreeIPA DNS A records** to new IPs before flipping any host,
-  so name resolution stays valid throughout the migration.
-- **variables.nix already updated** for `pxeServerIp` (.247→.223), `pbsIp` (.108→.244), and
-  new `domainControllerIp` (.253). Rebuild affected hosts after renumbering.
-- **Router DHCP**: once domain-controller is at .253 and FreeIPA DNS is serving `sweet.home`,
-  switch router DHCP on with pool .10–.59 and DNS option pointing to .253; retire Pi-hole CT.
-- **Pi-hole's iPXE dnsmasq config** (`99-ipxe-chainload.conf`) moves to the pxe-boot CT as a
-  dnsmasq proxy-mode config before Pi-hole is decommissioned.