router: stagingPort option, move gw-cnx-1 staging uplink into it

The pre-cutover DHCP-client uplink into the old LAN was a hand-written
systemd.network block in the gw-cnx-1 machine config. Make it a router
setting next to trunkPorts/accessPorts so every replacement gateway can
stage the same way, with an assertion that the port is not also the WAN,
a trunk or an access port. gw-cnx-1 sets stagingPort = "enp3s0" in the
inventory; the machine-local block is gone.

modules/clan/router/README.md

@@ -32,6 +32,7 @@ inventory.instances.router = {
     wan.vlanId = 10;                 # or null for untagged PPPoE
     trunkPorts = [ "enp2s0" ];
     accessPorts.enp4s0 = "mgmt";     # untagged on-site recovery port
+    # stagingPort = "enp3s0";       # DHCP uplink into the old LAN until cutover
     vlans = {
       mgmt.id = 10;
       lan.id = 20;