nixos/portcullis: Bring up 10G on the home hi VLAN

portcullis is wired over 10G to fergal, which uplinks to jim's spare
SFP+ port. That uplink is untagged VLAN 1, so hi is carried tagged on a
lan-hi VLAN interface: a static assignment at 192.168.68.41 / ::6:1,
resolving through the router VIPs like any other hi client. Its gateway
route outranks the DHCP default, making 10G the preferred path while the
2.5G bootstrap stays as a fallback. Deploy now targets that address.

The hi MTU goes on the .network rather than the .link, since a .link is
only applied at udev device-add -- with it there, et10g-0 stays at 1500
across a switch and lan-hi cannot take 9000.

jim's sfp-spare was tagged into hi and lo out of band to match.

fergal turns out to belong with portcullis rather than to the home
fabric -- it goes to Nikhef when the box does -- so its documentation
moves to the colony site, leaving home/switches.md a short section on
what it borrows from that fabric.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/networking.md

@@ -267,8 +267,9 @@ public blocks and the per-customer `mail` / `darts` / `jam` prefixes carry custo
 services with their own public addresses (announced by BGP, routed via the host).
 
 This layout is expected to change: [`portcullis`](sites/colony/portcullis.md) is bare-metal edge
-hardware headed for Nikhef that will take over most of `estuary`'s routing. It has no assignments
-yet and the replacement topology is still being designed.
+hardware headed for Nikhef that will take over most of `estuary`'s routing. It has no colony
+assignments yet (only a home `hi` one, from being staged at home) and the replacement topology is
+still being designed.
 
 ## home