feat(netinfra): DHCP hot-standby + dual-stack NTP/SNMP on netinfra pair [#420]

DNS/DHCP/NTP redundancy per founder ruling 2026-08-27:
- DHCP failover converted load-balance -> hot standby (split 255 on
  primary; secondary answers only if primary unreachable >3s). DHCP
  options now hand out BOTH nodes for DNS and NTP (active/active) —
  Tailscale hosts stay on MagicDNS 100.100.100.100.
- netinfra-02 ntpsec deployed (pool.ntp.org, all interfaces); 01
  repointed from debian pool zones to pool.ntp.org. NTP now redundant;
  GPS stratum-1 on pfvsvrpi tracked as follow-up ticket.
- snmpd on both nodes with scoped ACLs (LibreNMS LAN+TS sources only)
  and ntpq/dhcpd-lease extends — prep for DNS/DHCP/NTP graphing.
- Deployed sync-zones.sh (git version, DNS name instead of IP literal)
  to netinfra-02; zone sync verified 171/171 zones both nodes.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

netinfra/dhcp/dhcpd-primary.conf

@@ -3,6 +3,11 @@
 # Managed via Webmin DHCP module
 #
 # FAILOVER: this node is PRIMARY; peer is pfv-netinfra-02 (192.168.3.253)
+# DESIGN [#420, founder ruling 2026-08-27]: DHCP failover = active/passive
+#   hot standby (split 255: primary serves all hashes; secondary answers only
+#   when primary unreachable for >3s via 'load balance max seconds').
+#   DNS + NTP options hand out BOTH servers (active/active). Tailscale hosts
+#   use 100.100.100.100 MagicDNS, redundant to both netinfra TS IPs.
 
 # Global defaults
 option domain-name "knel.net";
@@ -25,7 +30,7 @@ failover peer "pfv-dhcp" {
   max-response-delay 30;
   max-unacked-updates 10;
   mclt 600;
-  split 128;
+  split 255;
   load balance max seconds 3;
 }