refactor: full repo sweep — variables, docs, and comment cleanup

- variables.nix: switch to rec {}, extract giteaDomain/giteaRepoPath,
  extraAdminSshKeys, haLanNfsFqdn, tailscaleResolverIp, ports.dhcp,
  ports.dns; ipaServer now derives from homeDomain ref; section headers
- modules: use new vars throughout (pxe-boot, ts-dns-forwarder,
  cluster-config, configuration.nix, mount-pxe-images) — eval unchanged
- docs: delete ephemeral planning docs (AUDIT_REPORT, ha-network-audit,
  network-cutover); add docs/ha.md; drop migration reference table from
  ip-addressing.md; remove stale server example from beszel.md
- CLAUDE.md/README.md/AGENTS.md: fix build types (tailscale-router,
  ha-server, drop server); document scripts/ha/, scripts/ipa/, and
  all previously undocumented top-level and lib scripts

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/build-types/pxe-boot.nix

@@ -6,6 +6,10 @@ let
   tftpRoot = "${pxeRoot}/tftp";
   pxeBaseUrl = "http://${vars.pxeServerIp}";
 
+  # Base network address extracted from lanCidr (e.g. "192.168.2.0" from
+  # "192.168.2.0/24") — used by dnsmasq's proxy DHCP range directive.
+  lanBaseAddr = lib.head (lib.splitString "/" vars.lanCidr);
+
   bootIpxe = pkgs.writeText "boot.ipxe" ''
     #!ipxe
 
@@ -73,16 +77,16 @@ let
     boot
   '';
 
-  # Kickstart file for domain-controller.sweet.home.
-  # Installs Rocky Linux 9, sets a static IP, creates wayne with the
-  # admin SSH key, then on first reboot runs ipa-server-install via a
-  # systemd oneshot service.  Passwords are generated at %post time,
-  # written to /root/ipa-credentials.txt (chmod 600), and read back by
-  # the first-boot script — never hardcoded here or in the repo.
+  # Kickstart file for ${vars.ipaServer}.
+  # Installs Rocky Linux 9, sets a static IP, creates ${vars.ipaUser} with
+  # the admin SSH key, then on first reboot runs ipa-server-install via a
+  # systemd oneshot service. Passwords are generated at %post time, written
+  # to /root/ipa-credentials.txt (chmod 600), and read back by the
+  # first-boot script — never hardcoded here or in the repo.
   rockyFreeIpaKs = pkgs.writeText "rocky-freeipa.ks" ''
     #version=RHEL9
     # Unattended Rocky Linux 9 + FreeIPA install
-    # Target: domain-controller.${vars.homeDomain}  ${vars.domainControllerIp}
+    # Target: ${vars.ipaServer}  ${vars.domainControllerIp}
 
     url --url=${rockyMirror}/BaseOS/${rockyArch}/os/
     repo --name=appstream --baseurl=${rockyMirror}/AppStream/${rockyArch}/os/
@@ -93,14 +97,14 @@ let
 
     # DHCP during install; static IP configured in %post via NM config file
     network --bootproto=dhcp --device=link --activate
-    network --hostname=domain-controller.sweet.home
+    network --hostname=${vars.ipaServer}
 
     selinux --enforcing
     firewall --enabled --service=ssh
 
     rootpw --lock
-    user --name=wayne --groups=wheel --shell=/bin/bash
-    sshkey --username=wayne "${vars.adminSshKey}"
+    user --name=${vars.ipaUser} --groups=wheel --shell=/bin/bash
+    sshkey --username=${vars.ipaUser} "${vars.adminSshKey}"
 
     zerombr
     clearpart --all --initlabel --drives=sda
@@ -148,7 +152,7 @@ let
 
     # -- /etc/hosts: FQDN must resolve to the real IP (not loopback) for IPA --
     sed -i '/domain-controller/d' /etc/hosts
-    echo '${vars.domainControllerIp} domain-controller.${vars.homeDomain} domain-controller' >> /etc/hosts
+    echo '${vars.domainControllerIp} ${vars.ipaServer} domain-controller' >> /etc/hosts
 
     # -- Generate IPA passwords and store securely --
     DM_PASS=$(openssl rand -base64 24 | tr -dc 'A-Za-z0-9' | head -c 24)
@@ -168,13 +172,13 @@ let
     ADMIN_PASS=$(grep '^IPA Admin:' /root/ipa-credentials.txt | awk '{print $NF}')
 
     ipa-server-install \
-      --realm=SWEET.HOME \
-      --domain=sweet.home \
-      --hostname=domain-controller.sweet.home \
+      --realm=${lib.strings.toUpper vars.homeDomain} \
+      --domain=${vars.homeDomain} \
+      --hostname=${vars.ipaServer} \
       --ds-password="$DM_PASS" \
       --admin-password="$ADMIN_PASS" \
       --setup-dns \
-      --forwarder=192.168.2.253 \
+      --forwarder=${vars.domainControllerIp} \
       --no-dnssec-validation \
       --no-ntp \
       --unattended
@@ -341,9 +345,7 @@ in
     atftpd = {
       enable = true;
       root = tftpRoot;
-      extraOptions = [
-        "--verbose=5"
-      ];
+      extraOptions = [ "--verbose=5" ];
     };
 
     openssh.settings.PermitRootLogin = "yes";
@@ -428,7 +430,7 @@ in
       # Without this dnsmasq tries to bind port 53 which systemd-resolved
       # already owns, causing startup failure.
       port = 0;
-      dhcp-range = [ "192.168.2.0,proxy" ];
+      dhcp-range = [ "${lanBaseAddr},proxy" ];
       dhcp-match = [
         "set:ipxe,175"
         "set:efi64,option:client-arch,7"
@@ -445,5 +447,5 @@ in
   };
 
   networking.firewall.allowedTCPPorts = [ vars.ports.pxeBootHttp ];
-  networking.firewall.allowedUDPPorts = [ vars.ports.pxeBootTftp 67 ];
+  networking.firewall.allowedUDPPorts = [ vars.ports.pxeBootTftp vars.ports.dhcp ];
 }