router: stagingPort option, move gw-cnx-1 staging uplink into it

The pre-cutover DHCP-client uplink into the old LAN was a hand-written
systemd.network block in the gw-cnx-1 machine config. Make it a router
setting next to trunkPorts/accessPorts so every replacement gateway can
stage the same way, with an assertion that the port is not also the WAN,
a trunk or an access port. gw-cnx-1 sets stagingPort = "enp3s0" in the
inventory; the machine-local block is gone.

inventory.nix

@@ -40,10 +40,11 @@ in
       wan.interface = "enp1s0";
       wan.vlanId = null; # this ISP runs PPPoE untagged on the port
       wan.macAddress = "a8:b8:e0:01:06:87";
-      trunkPorts = [
-        "enp2s0"
-        # "enp3s0" # STAGING: serves as the uplink until cutover (see the machine config)
-      ];
+      trunkPorts = [ "enp2s0" ];
+      # STAGING (remove at cutover, move enp3s0 back into trunkPorts):
+      # DHCP-client uplink into the existing OPNsense LAN so the box has
+      # internet + mesh while it runs alongside the old router.
+      stagingPort = "enp3s0";
       # Dedicated on-site recovery port: untagged mgmt, always available even
       # if the switch config is broken.
       accessPorts.enp4s0 = "mgmt";