feat(netinfra): DHCP hot-standby + dual-stack NTP/SNMP on netinfra pair [#420]

DNS/DHCP/NTP redundancy per founder ruling 2026-08-27:
- DHCP failover converted load-balance -> hot standby (split 255 on
  primary; secondary answers only if primary unreachable >3s). DHCP
  options now hand out BOTH nodes for DNS and NTP (active/active) —
  Tailscale hosts stay on MagicDNS 100.100.100.100.
- netinfra-02 ntpsec deployed (pool.ntp.org, all interfaces); 01
  repointed from debian pool zones to pool.ntp.org. NTP now redundant;
  GPS stratum-1 on pfvsvrpi tracked as follow-up ticket.
- snmpd on both nodes with scoped ACLs (LibreNMS LAN+TS sources only)
  and ntpq/dhcpd-lease extends — prep for DNS/DHCP/NTP graphing.
- Deployed sync-zones.sh (git version, DNS name instead of IP literal)
  to netinfra-02; zone sync verified 171/171 zones both nodes.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

netinfra/snmp/snmpd-netinfra-01.conf

@@ -0,0 +1,16 @@
+# snmpd.conf — pfv-netinfra-01 [#420] scoped ACL for LibreNMS instrumentation
+# Sources: tsys-librenms LAN (192.168.3.176) + Tailscale (100.86.204.77) only.
+# No broad subnet grants (founder ruling 2026-08-27, matches dcinfra/sensors pattern).
+sysLocation "Rack 3 netinfra (DNS/DHCP/NTP primary)"
+sysContact ops@turnsys.com
+
+agentaddress 127.0.0.1:161,192.168.3.252:161,100.70.181.72:161
+
+rocommunity kn3lmgmt 127.0.0.1
+rocommunity kn3lmgmt 192.168.3.176
+rocommunity kn3lmgmt 100.86.204.77
+
+# Instrumentation feeds for the monitoring session (DNS/DHCP/NTP graphing):
+extend ntpq /usr/bin/ntpq -c rv
+extend dhcpd-leases /bin/sh -c "grep -c '^lease' /var/lib/dhcp/dhcpd.leases"
+extend dhcpd-active /bin/sh -c "grep -c 'binding state active' /var/lib/dhcp/dhcpd.leases"