fix(ha): prevent drbd.service from starting alongside Pacemaker

drbd.service runs drbdadm up all at activation time, but Pacemaker's
OCF drbd agent manages the resource lifecycle (up/down/promote/demote).
When both run simultaneously the device is busy, causing drbdmeta
apply-al to abort with exit 20.

Set wantedBy = [] so the kernel module and config are still present
(via services.drbd.enable = true) but systemd doesn't auto-start the
service. Pacemaker's OCF agent calls drbdadm directly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/ha/cluster-config.nix

@@ -37,6 +37,12 @@
   # DRBD lock-file directory (drbd-utils checks for it; missing → harmless but noisy warnings).
   systemd.tmpfiles.rules = [ "d /var/lib/drbd 0750 root root -" ];
 
+  # Prevent drbd.service from auto-starting at boot / nixos-rebuild switch.
+  # Pacemaker's OCF drbd agent calls drbdadm up/down directly when managing
+  # the resource.  If drbd.service also runs drbdadm up all while DRBD is
+  # already Primary under Pacemaker, apply-al fails with "device busy" (exit 20).
+  systemd.services.drbd.wantedBy = lib.mkForce [];
+
   services.drbd = {
     enable = true;
     config = ''