nixos/portcullis: Bring up 10G on the home hi VLAN

portcullis is wired over 10G to fergal, which uplinks to jim's spare
SFP+ port. That uplink is untagged VLAN 1, so hi is carried tagged on a
lan-hi VLAN interface: a static assignment at 192.168.68.41 / ::6:1,
resolving through the router VIPs like any other hi client. Its gateway
route outranks the DHCP default, making 10G the preferred path while the
2.5G bootstrap stays as a fallback. Deploy now targets that address.

The hi MTU goes on the .network rather than the .link, since a .link is
only applied at udev device-add -- with it there, et10g-0 stays at 1500
across a switch and lan-hi cannot take 9000.

jim's sfp-spare was tagged into hi and lo out of band to match.

fergal turns out to belong with portcullis rather than to the home
fabric -- it goes to Nikhef when the box does -- so its documentation
moves to the colony site, leaving home/switches.md a short section on
what it borrows from that fabric.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/openwrt-flash.md

@@ -3,7 +3,7 @@
 Guided procedure for putting a flake-built OpenWrt image onto a box. The images themselves are
 declared in [`openwrt/default.nix`](../openwrt/default.nix) and described in
 [`deployment.md`](deployment.md#openwrt-images); the boxes are listed on their site pages (today
-that is [fergal](sites/home/switches.md#fergal-the-openwrt-switch)).
+that is [fergal](sites/colony/fergal.md)).
 
 Packages are baked into the image, so this runs whenever the package list changes — not only for
 version upgrades. Work through the phases in order; ⏸ marks the point to stop and confirm.
@@ -32,7 +32,7 @@ df -h /tmp                                        # room for the image
 
 **Flash or RAM matters.** A box booted normally shows a squashfs `/rom` plus a jffs2 `/overlay`;
 one booted from an initramfs has `/` on tmpfs. The initramfs case has its own hazards — see
-[Flashing from an initramfs](sites/home/switches.md#flashing-notes).
+[Flashing from an initramfs](sites/colony/fergal.md#flashing-notes).
 
 **Check the address is in UCI**, not just present on the interface. An address added by hand with
 `ip` disappears on reboot and the box comes back unreachable.
@@ -53,7 +53,7 @@ protocol if you prefer it.)
 
 For a box being flashed off its **vendor** firmware for the first time, back up the whole flash
 first — the vendor partitions hold per-unit MAC addresses and licence data that cannot be
-regenerated. See [fergal's flash layout](sites/home/switches.md#flash-layout).
+regenerated. See [fergal's flash layout](sites/colony/fergal.md#flash-layout).
 
 ## Phase 4 — Stage and validate