feat(gx10): rack networking — VLAN 50 via DHCP reservation, wired only

pfi-gx10 moved from desk Wi-Fi (10.100.10.226, VLAN 10) to the rack on
10.100.50.60 (nh3-servers, VLAN 50), reachable as pfi-gx10.nh3.internal.

The address is a DHCP RESERVATION on the UDM, not a host static. Operator
ruling during the move, and the better design: a host-side static works
until the box moves and is then a stale netplan file on a machine whose
address you no longer know. The pre-written playbook wrote a host static;
it is kept for its safety ordering and annotated as retired.

The port arrived on the native VLAN, not the server VLAN, so switch port 22
was repointed first. port_overrides is a whole-array PUT — two unrelated
overrides on ports 21 and 23 were read, preserved and written back, with the
original array backed up to a file before the change.

Wi-Fi stayed up as the escape hatch until the wired path was proven from
outside, and was downed last as its own step. The step worth keeping: while
Wi-Fi was up, traffic to nh3-dev still preferred wlP9s9 because that
interface sits directly on the userland subnet, so reachability proved
nothing about the wired path. `ping -I enP7s7` across the VLAN boundary is
what actually settled it before the hatch came down.

playbooks/gx10-rack-network.yaml

@@ -1,3 +1,23 @@
+# pfi-gx10 — RETIRED 2026-09-03. Kept for its reasoning, not for running.
+#
+# ⚠ THE STATIC-IP APPROACH IN THIS FILE WAS NOT USED. Operator ruling on the
+# day of the rack move: put the address on the SWITCH/FIREWALL side as a DHCP
+# RESERVATION and leave the host on DHCP, so moving the box later does not mean
+# unpicking a stale netplan static on a machine you may not be able to reach.
+# The host-static this playbook writes is exactly the "interesting adventure"
+# that ruling avoids.
+#
+# What was actually done instead (see docs/runbooks/gx10-rack-network.md):
+#   1. UniFi switch port 22 native network -> nh3-servers (VLAN 50)
+#   2. UniFi client reservation: 30:c5:99:3d:a7:45 -> 10.100.50.60
+#   3. host DHCP renew; Wi-Fi left UP until the wired path was proven
+#   4. dns/internal.yaml + dns-sync
+#   5. nmcli radio wifi off, last, as its own step
+#
+# The safety ORDER below is still right and was followed: verify carrier,
+# verify MAC not interface name, keep Wi-Fi up as the escape hatch, prove the
+# new address from OUTSIDE, tear the hatch down separately and last.
+#
 # pfi-gx10 — move from desk (Wi-Fi + DHCP, VLAN 10) to rack (wired static,
 # VLAN 50 nh3-servers). Run AFTER the box is racked and the switch port has
 # been placed on nh3-servers.