Add untagged access ports and a staging uplink for gw-cnx-1

New cnx.router.accessPorts option pins a port untagged to one VLAN via
bridge PVID/EgressUntagged; convention is the last copper port as an
always-available mgmt recovery port. gw-cnx-1 port roles: enp1s0 WAN,
enp2s0 trunk, enp3s0 temporary DHCP uplink into the old OPNsense LAN
(back to trunk at cutover), enp4s0 untagged mgmt.

machines/gw-cnx-1/configuration.nix

@@ -28,9 +28,11 @@
     wan.vlanId = null; # this ISP runs PPPoE untagged on the port
     trunkPorts = [
       "enp2s0"
-      "enp3s0"
-      "enp4s0"
+      # "enp3s0" # STAGING: serves as the uplink below until cutover
     ];
+    # Dedicated on-site recovery port: untagged mgmt, always available even
+    # if the switch config is broken.
+    accessPorts.enp4s0 = "mgmt";
     # Replaces the newedge.house OPNsense box; renumbered to the fleet
     # convention (10.1.<vlanId>.0/24, router .1, pool .100-.199). The old
     # untagged LAN becomes tagged mgmt — infra switch ports get PVID 10.
@@ -73,6 +75,17 @@
     };
   };
 
+  # STAGING (remove at cutover, and restore enp3s0 to trunkPorts): DHCP-client
+  # uplink into the existing OPNsense LAN so the box has internet + mesh while
+  # it runs alongside the old router. Default-deny firewall on this interface
+  # (it's in no VLAN zone); PPPoE simply retries until the WAN port is cabled.
+  # Do NOT connect the trunk ports to the production switch while staging —
+  # Kea on tag 10 would fight the OPNsense LAN DHCP in one broadcast domain.
+  systemd.network.networks."05-staging" = {
+    matchConfig.Name = "enp3s0";
+    networkConfig.DHCP = "ipv4";
+  };
+
   time.timeZone = "Etc/GMT-7"; # UTC+7 (Thailand, fixed offset, no DST)
   services.chrony.enable = true;
 }