feat(nh3-pve): prepare for GPU install — pin NIC names by MAC, pull AMT port from vmbr0

nh3-pve and esh-pve are the same Minisforum MS-01 (BIOS AHWSA.1.17). With a
card in the x16 slot its root port takes bus 01 and every NIC moves down a
bus (measured on esh-pve), so predictable names change (enp2s0f0np0 ->
enp3s0f0np0 etc.) and vmbr0 would boot with no uplink. systemd .link files
now pin all NICs by MAC, baked into every initramfs and synced to the ESP;
udev confirms the files apply. The AMT-capable I226-LM (enp88s0) leaves
vmbr0's bridge-ports in the file (next boot), so cabling it for AMT cannot
loop the STP-less bridge.

Also: documented the NanoKVM (https://10.100.250.171) as nh3-pve's console
OOB and that AMT is not wired; nh3-dev's Beszel agent no longer binds NAS
shares (it died on the last NH3 cold start); post-boot checklist in
persistent-memory.

servers/nh3-pve/README.md

@@ -43,6 +43,39 @@ on), which is the root path into pbs-nh3; infra-ops is not provisioned there.
 **pfi-gx10 (`10.100.50.60`) is bare metal on this site, not a guest here**, and did
 not power back on by itself.
 
+## Hardware identity, OOB, and the GPU-slot NIC-rename trap (2026-09-25)
+
+- **Box:** Minisforum MS-01 ("Venus Series", BIOS `AHWSA.1.17`): the same model
+  and BIOS as esh-pve. i9-13900H, X710 2×SFP+, I226-V + **I226-LM (vPro/AMT)**,
+  one PCIe x16 slot (x8 electrical, low-profile, single-slot, slot power only).
+- **Uplink:** only `enp2s0f0np0` (SFP+ 10G) has a cable. The bridge carries the
+  I226-V's MAC `…:96:0d` because it is the first port listed.
+- **AMT: NOT wired.** The AMT-capable I226-LM (`enp88s0`, MAC `58:47:ca:76:96:0e`)
+  has no cable. The ME is present (`/dev/mei0`, "AMT SOL Redirection" 00:16.3), but
+  MEBx provisioning status is unknown. To wire it: cable the LM port, then at boot
+  press Ctrl+P → set the MEBx password, enable manageability, set network (static
+  or DHCP), KVM on, User Opt-in = None, activate network access. MEBx can be driven
+  remotely through the NanoKVM below.
+- **Console OOB exists: a Sipeed NanoKVM** is attached (USB `3346:1009` on the host;
+  web UI **`https://10.100.250.171`**, switch port 23, nh3-mgmt). It gives video and
+  keyboard, so BIOS, MEBx and a host that booted without network are all reachable
+  remotely. Power control through it is unverified (the MS-01 has no standard ATX
+  front-panel header). ⚠ It captures the **iGPU's HDMI**, and RTX-class cards output
+  mini-DP only, so keep the BIOS primary display on the iGPU after a GPU install.
+- ⚠ **A GPU in the slot RENAMES every NIC.** With a card present the slot's root
+  port 00:01.0 takes PCI bus 01 and everything behind it moves down a bus (measured
+  on esh-pve): X710 02→03, I226-V 57→58, I226-LM 58→59, Wi-Fi 59→5a. The names
+  would become `enp3s0f0np0`, `enp88s0`, `enp89s0`, `wlp90s0`. vmbr0 would then boot
+  with no uplink and take the whole NH3 site's VMs off the network.
+  **Pinned 2026-09-25** by MAC with `/etc/systemd/network/10-pin-*.link`, also baked
+  into every initramfs and synced to the ESP (`playbooks/nh3-pve-pin-nic-names.yaml`,
+  verified with `udevadm test-builtin net_setup_link`). If the host ever boots
+  without network anyway: open the NanoKVM console, run `ip -br link`, and compare
+  names against `/etc/network/interfaces` (backup in `/root/nic-pin-2026-09-25/`).
+- **`enp88s0` (the AMT port) is no longer a vmbr0 bridge port** (file edited
+  2026-09-25, effective next boot). STP is off, so bridging a second cabled uplink
+  into the same L2 would loop the site LAN.
+
 ## Refresh state
 
 ```bash