fix: keep UCS on spinning disk, repurpose D3 SSD for k8s/CI workloads

UCS (LDAP/AD) does not need SSD. Corrected placement:
- ucs-01 stays on D2 (tsys4 HDD) -- no change needed
- ucs-02 moves from D5 (tsys4) to S2 (tsys5 HDD) for cross-server
  redundancy only, not for speed

D3 SSD (moving to tsys5 Friday) is now freed for workloads that
actually benefit: sectestbed k8s nodes, CI/CD artifact cache, or a
container image registry mirror.

Added storage tier characterization per host (tsys4 = bulk/spinning
only, tsys5 = hybrid fast-tier hub, tsys2/3 = SSD/NVMe only). Added
UCS migration TODO item for today.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

TODO.md

@@ -206,7 +206,31 @@ After the NVMe is physically installed and visible in Proxmox:
 
 ---
 
-## 5. Open questions for next session
+## 5. UCS storage migration to spinning disk (do today)
+
+UCS (Univention Corporate Server / open-source AD) does not need SSD. Both
+UCS VMs should stay on spinning disk (HDD) and be split across storage
+servers for redundancy.
+
+| VM | Current | Target | Action |
+|----|---------|--------|--------|
+| ucs-01 (108) | D2 (tsys4 HDD) | **D2 (tsys4 HDD) -- no change** | Already correct |
+| ucs-02 (902) | D5 (tsys4 HDD) | **S2 (tsys5 HDD)** | Move for cross-server redundancy |
+
+**To migrate ucs-02 to S2:**
+1. Shut down VM 902 on tsys9
+2. Copy disk: `cp /mnt/pve/D5/902/vm-902-disk-0.qcow2 /mnt/pve/S2/902/`
+3. Update VM 902 config: change `scsi0` from `D5:902/...` to `S2:902/...`
+4. Start VM 902, verify it boots and LDAP/AD services are healthy
+5. Remove old disk from D5
+
+Note: both VMs are currently on tsys4 HDD, which is fine for UCS. Only
+ucs-02 needs to move -- it should be on a different storage server than
+ucs-01 so a tsys4 failure doesn't take down both halves of the AD pair.
+
+---
+
+## 6. Open questions for next session
 
 - Are the hosts a Proxmox cluster (`pvecm status`) or standalone installs?
   Determines whether live migration is available.