feat(pfi-gx10): rack-move network playbook — VLAN 50, static 10.100.50.60

Target settled: nh3-servers VLAN 50, static 10.100.50.60. Clear of the four
existing statics and below the .150 DHCP pool where fleet statics live.

The playbook never leaves itself one path back. Wi-Fi stays up throughout while
the wired interface is configured beside it; the new address is verified from
outside before anything is torn down, and Wi-Fi teardown is explicitly a
separate later change. A botched netplan therefore costs a retry over Wi-Fi
rather than a trip to the rack — which is what substitutes for 'netplan try',
whose interactive rollback needs a TTY that elway cannot provide.

Two preconditions are asserted as steps rather than assumed: the interface must
have carrier (writing a static config for a dead NIC and reporting success is
the failure this avoids), and its MAC must match, since interface names can
renumber across kernels but MACs do not.

Requires nothing from the operator beyond racking the box. The wired NIC has a
distinct MAC from the Wi-Fi one, so the post-move address and switch port are
both discoverable from the UDM rather than needing to be relayed.

servers/pfi-gx10/README.md

@@ -16,11 +16,26 @@ Grace-Blackwell desktop supercomputer. Registered 2026-09-01.
 As of 2026-09-01 this box is **on a desk, on Wi-Fi**, holding a DHCP lease at
 `10.100.10.226` on `nh3-userland` (VLAN 10). Ethernet `enP7s7` has no carrier.
 
-It is going into the rack later. At that point it needs a wired link, a static
-address, a decision about VLAN placement (a compute node arguably belongs on
-`nh3-servers`, VLAN 50, with the rest of them), a `dns/internal.yaml` entry, and
-this file plus `ssh-target` updated. **None of that was configured now** — an
-address that is about to be wrong is worse than DHCP.
+It is going into the rack later. **Target settled (operator, 2026-09-01):
+`nh3-servers`, VLAN 50, static `10.100.50.60`** — clear of `.40` nh3-docker,
+`.42` nh3-extdev, `.50` nh3-nas, `.90` pbs-nh3, and below the `.150` DHCP pool
+where fleet statics live.
+
+Nothing was configured on the desk — an address that is about to be wrong is
+worse than DHCP. The move is `playbooks/gx10-rack-network.yaml`.
+
+**Nothing is needed from the operator beyond racking it.** The wired NIC has its
+own MAC (`30:c5:99:3d:a7:45`, distinct from the Wi-Fi `50:bb:b5:a2:00:a8`), so
+its post-move address is discoverable from the UDM without being told:
+
+```bash
+curl -sk "https://10.100.0.1/proxy/network/api/s/default/stat/sta" \
+  -H "X-API-KEY: $(secret get unifi/pfi-udmse-api-key)" \
+  | python3 -c "import json,sys;[print(c['ip'],c.get('sw_port')) for c in json.load(sys.stdin)['data'] if c['mac']=='30:c5:99:3d:a7:45']"
+```
+
+That also returns the switch port, which must be set to the `nh3-servers`
+network or the box lands back on VLAN 10.
 
 Expect ~65–80 ms RTT until it is wired. That is Wi-Fi power-save, not a fault.