feat(networking): declare static IPs for all NixOS-managed hosts in flake

Adds static IP configuration to every NixOS host in the flake that
has a fixed LAN address, and centralises all network primitives
(IPs, gateway, prefix length, interface names) in variables.nix so
there is one place to update if any of them change.

variables.nix additions:
- lanGateway / lanPrefixLength — LAN gateway and /24 prefix, replacing
  every hardcoded 192.168.2.254 / 24 across host files
- lxcLanInterface / vmLanInterface / vmStorageInterface — NIC names for
  LXC containers (eth0), Proxmox VMs (ens18), and the HA storage NIC
  (ens19), used as attribute keys so changing the name is a one-line edit
- haStoragePrefixLength — /29 for the storage subnet, mirrors haStorageCidr
- Per-host IP variables: nixCacheIp (.224), tailscaleRouterIp (.222),
  torRelayIp (.221), serverIp (.226), dockerIp (.225)

host.nix changes:
- tailscale-router, tor-relay, nix-cache, pxe-boot: useDHCP = false,
  static address on eth0 (lxcLanInterface), struct-form defaultGateway
  (required when using systemd-networkd which LXC containers use)
- server, docker: useDHCP = false, static address on ens18 (vmLanInterface),
  struct-form defaultGateway (works for both scripted networking and networkd)
- ha-server-1, ha-server-2: replace hardcoded 192.168.2.254 / 24 / 29
  with the new variables; no functional change for these hosts

modules/build-types/pxe-boot.nix:
- Domain-controller kickstart template: replace hardcoded 192.168.2.138
  and 192.168.2.254 with vars.domainControllerIp / vars.lanGateway /
  vars.lanPrefixLength / vars.homeDomain so the template stays correct
  if the DC IP or domain is ever changed again

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ULXzafSDwGhmFGnn3LtDSQ

modules/build-types/pxe-boot.nix

@@ -82,7 +82,7 @@ let
   rockyFreeIpaKs = pkgs.writeText "rocky-freeipa.ks" ''
     #version=RHEL9
     # Unattended Rocky Linux 9 + FreeIPA install
-    # Target: domain-controller.sweet.home  192.168.2.138
+    # Target: domain-controller.${vars.homeDomain}  ${vars.domainControllerIp}
 
     url --url=${rockyMirror}/BaseOS/${rockyArch}/os/
     repo --name=appstream --baseurl=${rockyMirror}/AppStream/${rockyArch}/os/
@@ -136,10 +136,10 @@ let
 
     [ipv4]
     method=manual
-    addresses=192.168.2.138/24
-    gateway=192.168.2.254
-    dns=192.168.2.253;
-    dns-search=sweet.home;
+    addresses=${vars.domainControllerIp}/${toString vars.lanPrefixLength}
+    gateway=${vars.lanGateway}
+    dns=${vars.domainControllerIp};
+    dns-search=${vars.homeDomain};
 
     [ipv6]
     method=auto
@@ -148,7 +148,7 @@ let
 
     # -- /etc/hosts: FQDN must resolve to the real IP (not loopback) for IPA --
     sed -i '/domain-controller/d' /etc/hosts
-    echo '192.168.2.138 domain-controller.sweet.home domain-controller' >> /etc/hosts
+    echo '${vars.domainControllerIp} domain-controller.${vars.homeDomain} domain-controller' >> /etc/hosts
 
     # -- Generate IPA passwords and store securely --
     DM_PASS=$(openssl rand -base64 24 | tr -dc 'A-Za-z0-9' | head -c 24)