feat(gx10): rack networking — VLAN 50 via DHCP reservation, wired only

pfi-gx10 moved from desk Wi-Fi (10.100.10.226, VLAN 10) to the rack on
10.100.50.60 (nh3-servers, VLAN 50), reachable as pfi-gx10.nh3.internal.

The address is a DHCP RESERVATION on the UDM, not a host static. Operator
ruling during the move, and the better design: a host-side static works
until the box moves and is then a stale netplan file on a machine whose
address you no longer know. The pre-written playbook wrote a host static;
it is kept for its safety ordering and annotated as retired.

The port arrived on the native VLAN, not the server VLAN, so switch port 22
was repointed first. port_overrides is a whole-array PUT — two unrelated
overrides on ports 21 and 23 were read, preserved and written back, with the
original array backed up to a file before the change.

Wi-Fi stayed up as the escape hatch until the wired path was proven from
outside, and was downed last as its own step. The step worth keeping: while
Wi-Fi was up, traffic to nh3-dev still preferred wlP9s9 because that
interface sits directly on the userland subnet, so reachability proved
nothing about the wired path. `ping -I enP7s7` across the VLAN boundary is
what actually settled it before the hatch came down.

dns/internal.yaml

@@ -75,6 +75,7 @@ hosts:
 
   # ---- nh3: NH3 office ----
   - {name: nh3-docker,       site: nh3, v4: 10.100.50.40,   note: general-purpose docker host + AdGuard}
+  - {name: pfi-gx10,       site: nh3, v4: 10.100.50.60,  note: GB10 Grace Blackwell, 121 GB unified — DHCP RESERVATION on the UDM, not a host static, so the box stays portable}
   - {name: nh3-dev,          site: nh3, v4: 10.100.10.50,   note: dev box, fleet sidecars, Claude sessions}
   - {name: nh3-extdev,       site: nh3, v4: 10.100.50.42,   note: manager / external-dev box}
   - {name: nh3-nas,          site: nh3, v4: 10.100.50.50,   note: Synology RS2418+}