router: stagingPort option, move gw-cnx-1 staging uplink into it

The pre-cutover DHCP-client uplink into the old LAN was a hand-written
systemd.network block in the gw-cnx-1 machine config. Make it a router
setting next to trunkPorts/accessPorts so every replacement gateway can
stage the same way, with an assertion that the port is not also the WAN,
a trunk or an access port. gw-cnx-1 sets stagingPort = "enp3s0" in the
inventory; the machine-local block is gone.

modules/clan/router/interface.nix

@@ -250,6 +250,22 @@ in
       '';
     };
 
+    stagingPort = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "enp3s0";
+      description = ''
+        Temporary DHCPv4-client uplink into the existing LAN while the box
+        runs alongside the router it replaces: gives it internet + mesh
+        before the WAN port is cabled (PPPoE simply retries until then). The
+        port is in no VLAN zone; the firewall admits only SSH on it. Do NOT
+        connect the trunk ports to the production switch while staging —
+        Kea on the mgmt tag would fight the old router's DHCP in one
+        broadcast domain. Set to null at cutover (and usually hand the port
+        back to `trunkPorts`).
+      '';
+    };
+
     vlans = lib.mkOption {
       type = lib.types.attrsOf (lib.types.submodule vlanModule);
       description = "VLANs served at this site; `mgmt` and `lan` are mandatory.";