refactor: full repo sweep — variables, docs, and comment cleanup

- variables.nix: switch to rec {}, extract giteaDomain/giteaRepoPath,
  extraAdminSshKeys, haLanNfsFqdn, tailscaleResolverIp, ports.dhcp,
  ports.dns; ipaServer now derives from homeDomain ref; section headers
- modules: use new vars throughout (pxe-boot, ts-dns-forwarder,
  cluster-config, configuration.nix, mount-pxe-images) — eval unchanged
- docs: delete ephemeral planning docs (AUDIT_REPORT, ha-network-audit,
  network-cutover); add docs/ha.md; drop migration reference table from
  ip-addressing.md; remove stale server example from beszel.md
- CLAUDE.md/README.md/AGENTS.md: fix build types (tailscale-router,
  ha-server, drop server); document scripts/ha/, scripts/ipa/, and
  all previously undocumented top-level and lib scripts

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/common/configuration.nix

@@ -5,13 +5,13 @@ let
     sudo nixos-rebuild switch \
       --no-write-lock-file \
       --refresh \
-      --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target)
+      --flake git+https://${vars.giteaDomain}/${vars.giteaRepoPath}.git#$(cat /etc/flake-target)
   '';
   testCmd = ''
     sudo nixos-rebuild test \
       --no-write-lock-file \
       --refresh \
-      --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target)
+      --flake git+https://${vars.giteaDomain}/${vars.giteaRepoPath}.git#$(cat /etc/flake-target)
   '';
   buildImageFn = ''
     buildImage() {
@@ -39,21 +39,18 @@ in
     };
     interactiveShellInit = buildImageFn;
   };
+
   networking.networkmanager.enable = true;
 
   # Recommended over the true default (bypasses ZFS's own import safeguards)
   # per the option's own docs; matches hosts/docker/host.nix and
-  # modules/services/zfs/enable-service.nix, which already set this
-  # explicitly. Harmless no-op on hosts that don't use ZFS at all.
+  # modules/services/zfs/enable-service.nix. Harmless no-op on hosts without ZFS.
   boot.zfs.forceImportRoot = false;
 
-  # Set your time zone.
   time.timeZone = vars.timeZone;
 
-  # Enable QEMU agent
   services.qemuGuest.enable = true;
 
-  # Enable docker-compose
   environment.systemPackages = with pkgs; [
     vim
     btop
@@ -63,11 +60,10 @@ in
   ];
 
   # Secrets shared by every host, decrypted at activation via each host's
-  # existing SSH host key (sops-nix derives the age key from
-  # /etc/ssh/ssh_host_ed25519_key automatically — see modules/common/README
-  # or docs/ for the sops workflow). hashedPassword/hashedPasswordFile need
+  # SSH host key (sops-nix derives the age key from
+  # /etc/ssh/ssh_host_ed25519_key automatically). hashedPassword secrets need
   # neededForUsers so they're available before the normal secret-activation
-  # step, since user creation happens very early in boot.
+  # step — user creation happens very early in boot.
   sops = {
     defaultSopsFile = ../../secrets/common.yaml;
 
@@ -77,9 +73,9 @@ in
       "nix-github-token" = { };
     };
 
-    # nix.conf doesn't support a *File-style option for access-tokens, so the
-    # token is rendered into a runtime-only file (never touches the Nix store)
-    # and pulled in via nix.conf's native !include directive.
+    # nix.conf has no *File-style option for access-tokens, so the token is
+    # rendered into a runtime-only file (never touches the Nix store) and
+    # pulled in via nix.conf's native !include directive.
     templates."nix-github-token.conf".content = ''
       access-tokens = github.com=${config.sops.placeholder."nix-github-token"}
     '';
@@ -90,12 +86,11 @@ in
   '';
 
   users = {
-    # With mutableUsers = false, update-users-groups.pl enforces hashedPasswordFile
-    # on every activation regardless of whether the account already exists in
-    # /etc/shadow. The default (true) only applies hashedPasswordFile to newly-
-    # created accounts — which means a freshly-built proxmox disk image (where
-    # activation runs without a usable sops key, so both accounts land in shadow
-    # with ‘!’) will never have its passwords fixed by subsequent boots.
+    # mutableUsers = false makes update-users-groups.pl enforce hashedPasswordFile
+    # on every activation, not just on newly-created accounts. Without this, a
+    # freshly-built proxmox disk image (activation runs without a usable sops key,
+    # so both accounts land in shadow with '!') will never have its passwords fixed
+    # by subsequent boots.
     mutableUsers = false;
 
     users.root = {
@@ -104,39 +99,23 @@ in
 
     users.${vars.primaryUser} = {
       isNormalUser = true;
-      extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
-      packages = with pkgs; [
-        tree
-      ];
+      extraGroups = [ "wheel" ];
+      packages = with pkgs; [ tree ];
       hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path;
-      openssh.authorizedKeys.keys = [
-        vars.adminSshKey
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGygkCljN6uKpdJbHTOQtn8ZnH+wKXDLAwrDFbLrE/65 nixos@nixos"
-      ];
+      openssh.authorizedKeys.keys = [ vars.adminSshKey ] ++ vars.extraAdminSshKeys;
     };
   };
 
-
-  # Enable the OpenSSH daemon.
   services.openssh.enable = true;
 
-  #Enable flakes
-
   nix.settings = {
     experimental-features = [ "nix-command" "flakes" ];
     auto-optimise-store = true;
   };
 
-
   programs.git = {
     enable = true;
     package = pkgs.git;
-    config = {
-      credential.helper = "store";
-    };
+    config.credential.helper = "store";
   };
-
-
-
 }