Fix HA failover etcd: advertise via WAN port-forward, not the Netbird mesh IP

UniFi's router has no route to 100.108.0.0/16 (the Netbird mesh CIDR) -
it only routes to its own directly-connected LAN. Advertising
talos-cp-01's real Netbird-bound IP (100.108.42.109, confirmed live via
talosctl to be genuinely bound to its wt0 interface - it's real, just
unreachable from outside the mesh) as the etcd client/peer URL would
never actually work for inbound WAN traffic from the VPS/witness.

Corrected to advertise home.kube.huskypup.net on the WAN ports that will
be port-forwarded (12379/12380) to talos-cp-01's real LAN IP
(172.28.101.41) + the NodePort Service - UniFi can route to its own LAN
natively, no extra static routes needed.

infrastructure/ha-failover/manifests/etcd.yaml

@@ -9,11 +9,23 @@
 #
 # Pinned to a specific node (talos-cp-01) via nodeSelector so its
 # advertised peer/client URLs (which must be stable, not "whichever node
-# it landed on today") stay correct. Reachable from the VPS/witness via
+# it landed on today") stay correct.
-# that node's real IP - confirmed live 2026-08-19 that home nodes are
+#
-# directly reachable from Netbird mesh peers on their node IP (the
+# Reachable from the VPS/witness via a UniFi WAN port-forward + a
-# netbird-egress DaemonSet's route) - and exposed via a NodePort Service,
+# source-IP-restricted WAN_IN firewall rule (limited to just the VPS and
-# which needs infrastructure/kyverno/policies/ha-failover-nodeport-exception.yaml
+# witness public IPs) - NOT via the Netbird mesh directly. talos-cp-01
+# does have a real, host-bound Netbird IP (100.108.42.109 on its wt0
+# interface, confirmed live via `talosctl get addresses`), but that's a
+# dead end for inbound WAN traffic: UniFi's router only has a route to
+# its own directly-connected LAN (172.28.101.0/24), nothing advertises
+# 100.108.0.0/16 to it, so a port-forward targeting the Netbird IP would
+# never actually route. The port-forward instead targets talos-cp-01's
+# real LAN IP (172.28.101.41) - NodePort Services bind on every interface
+# on a node, so the same ports are reachable there too, and that's an
+# address UniFi can actually route to natively.
+#
+# The NodePort Service itself needs
+# infrastructure/kyverno/policies/ha-failover-nodeport-exception.yaml
 # (disallow-nodeport-services is enforced cluster-wide otherwise).
 apiVersion: v1
 kind: Namespace
@@ -56,10 +68,10 @@ spec:
             - --name=home
             - --data-dir=/var/lib/etcd/data
             - --listen-client-urls=http://0.0.0.0:2379
-            - --advertise-client-urls=http://100.108.42.109:32379
+            - --advertise-client-urls=http://home.kube.huskypup.net:12379
             - --listen-peer-urls=http://0.0.0.0:2380
-            - --initial-advertise-peer-urls=http://100.108.42.109:32380
+            - --initial-advertise-peer-urls=http://home.kube.huskypup.net:12380
-            - --initial-cluster=home=http://100.108.42.109:32380,vps=http://100.108.113.41:2380,witness=http://100.108.130.74:2380
+            - --initial-cluster=home=http://home.kube.huskypup.net:12380,vps=http://100.108.113.41:2380,witness=http://100.108.130.74:2380
             - --initial-cluster-state=new
             - --initial-cluster-token=ha-failover-quorum
           ports: