refactor: full repo sweep — variables, docs, and comment cleanup

- variables.nix: switch to rec {}, extract giteaDomain/giteaRepoPath,
  extraAdminSshKeys, haLanNfsFqdn, tailscaleResolverIp, ports.dhcp,
  ports.dns; ipaServer now derives from homeDomain ref; section headers
- modules: use new vars throughout (pxe-boot, ts-dns-forwarder,
  cluster-config, configuration.nix, mount-pxe-images) — eval unchanged
- docs: delete ephemeral planning docs (AUDIT_REPORT, ha-network-audit,
  network-cutover); add docs/ha.md; drop migration reference table from
  ip-addressing.md; remove stale server example from beszel.md
- CLAUDE.md/README.md/AGENTS.md: fix build types (tailscale-router,
  ha-server, drop server); document scripts/ha/, scripts/ipa/, and
  all previously undocumented top-level and lib scripts

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/pxe-boot/mount-pxe-images.nix

@@ -1,10 +1,10 @@
 { config, lib, vars, ... }:
 
 let
-  # FQDN of the LAN NFS VIP (Pacemaker vip-lan, 192.168.2.229). Using the
-  # FQDN rather than a raw IP or bare hostname avoids systemd-resolved LLMNR
-  # quirks and survives a future VIP renumber via a DNS-only update.
-  nfsServer = "ha-vip-lan.${vars.homeDomain}";
+  # FQDN of the LAN NFS VIP (Pacemaker vip-lan, 192.168.2.229). Defined in
+  # variables.nix as haLanNfsFqdn; using the FQDN avoids systemd-resolved
+  # LLMNR quirks and survives a future VIP renumber via a DNS-only update.
+  nfsServer = vars.haLanNfsFqdn;
 in
 {
   fileSystems.${vars.nfsShares.pxebootImages.mountpoint} = {