feat(ha): promote HA file server to production flake targets

Adds proxmox-ha-server-1 and proxmox-ha-server-2 as real mkTarget entries
alongside the existing proxmox-server, backed by a new ha-server build type.

New modules
  modules/ha/cluster-config.nix — DRBD resource + corosync nodelist sourced
    from vars (haServer1Host/Ip, haServer2Host/Ip); resource-only fencing for
    production STONITH; HA port firewall rules for DRBD, iSCSI, Corosync, pcsd
  modules/build-types/ha-server.nix — imports pacemaker-stack + iscsi-target
    + cluster-config + beszel; NFS exports from vars.haStorageRoot (XFS-over-DRBD
    mount); nfs-server.service.wantedBy force-cleared so Pacemaker controls
    start/stop on the Active node only

New hosts
  hosts/ha-server-{1,2}/host.nix — static IP from vars, unique hostId; sops
    secrets (beszel, corosync authkey) are TODOs pending sync-host-keys.sh

variables.nix
  haServer1/2Host, haServer1/2Ip, haServerVip, haStorageRoot, haIscsiIqn
  ports.haServerDrbd/Iscsi/Corosync{1,2,Crypto}/PacemakerRemoted/Pcsd

scripts/ha/ (migrated + updated from test-lab/ha/)
  cluster-init.sh — generates corosync authkey, initialises DRBD/XFS/iSCSI,
    creates NFS dataset dirs, configures Pacemaker with DRBD + XFS + iSCSI
    + nfs-server + VIP; STONITH disabled initially (enable separately)
  cluster-enable-stonith.sh — enables fence_pve_ssh STONITH after key deploy
  fence-pve-ssh.py — Proxmox SSH fence agent (node names updated to ha-server-1/2)
  acceptance-tests.sh — T1–T7 production acceptance tests

test-lab/ha/ removed — all Nix config moved to modules/ha/ and
  modules/build-types/; scripts moved to scripts/ha/

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HaH1cSGvhogRP5ExoF6nD8

flake.nix

@@ -130,35 +130,10 @@
         lxc-tailscale-router = mkTarget { platform = "lxc"; buildType = "tailscale-router"; hostPath = ./hosts/tailscale-router/host.nix; };
 
         lxc-tor-relay = mkTarget { platform = "lxc"; buildType = "tor-relay"; hostPath = ./hosts/tor-relay/host.nix; };
-      };
 
-      # ── HA test lab VMs ─────────────────────────────────────────────────
-      # Two throwaway NixOS VMs to test the DRBD + XFS + LIO + Pacemaker
-      # stack.  Deliberately bypass mkTarget (no clan-core, no sops-nix,
-      # no home-manager) — these are disposable and must be destroyed once
-      # the acceptance tests are done.
-      # Build disk images with:
-      #   nix build .#nixosConfigurations.ha-test-node1.config.system.build.diskoImagesScript
-      # then run the script to produce ha-test-node1.raw (import with qm importdisk).
-      haTestTargets =
-        let
-          haNode = { nodeModule }: nixpkgs.lib.nixosSystem {
-            inherit system;
-            modules = [
-              inputs.disko.nixosModules.disko
-              ./modules/hardware-configuration/vm/proxmox.nix
-              ./modules/boot/efi.nix
-              ./test-lab/ha/disko.nix
-              ./test-lab/ha/common.nix
-              nodeModule
-            ];
-            specialArgs = { inherit vars; };
-          };
-        in
-        {
-          ha-test-node1 = haNode { nodeModule = ./test-lab/ha/node1.nix; };
-          ha-test-node2 = haNode { nodeModule = ./test-lab/ha/node2.nix; };
-        };
+        proxmox-ha-server-1 = mkTarget { platform = "proxmox"; buildType = "ha-server"; hostPath = ./hosts/ha-server-1/host.nix; };
+        proxmox-ha-server-2 = mkTarget { platform = "proxmox"; buildType = "ha-server"; hostPath = ./hosts/ha-server-2/host.nix; };
+      };
 
       # Auto-install environments (migrated from the former nix-auto-installer
       # flake): a self-contained NixOS installer that boots, discovers this
@@ -235,7 +210,7 @@
     in
     {
 
-      nixosConfigurations = generatedTargets // haTestTargets // installerTargets;
+      nixosConfigurations = generatedTargets // installerTargets;
 
       # Buildable auto-installer artifacts (`nix build .#<name>`). No `lxc`
       # variant (installer-boots-as-an-LXC-container) or `all` bundle