machines/stellio: give the AIS /64 to vlan-lan, not whichever VLAN came up first

Clients on stellio's lan had no global IPv6. AIS delegates a single /64
over PPPoE; cnx-network's router service carves the VLAN prefixes with
SubnetId=auto, so vlan-mgmt took the whole prefix and vlan-lan logged
"Couldn't find a suitable prefix. Ran out of address space" -- no RA
prefix on lan.

Pin SubnetId: 0x0 on vlan-lan (the whole /64), 0x1 on vlan-mgmt (out of
range on a /64, harmless; works unchanged if AIS ever delegates wider).
Verified live via runtime drop-ins: vlan-lan got 2405:9800:b910:1f5d::/64
and a LAN client pinged 2606:4700:4700::1111 over v6.

Drop once cnx-network carries the per-VLAN `ipv6SubnetId` option
(cnx-network-clan commit 27c697a) and the input is bumped.

machines/stellio/configuration.nix

@@ -94,6 +94,20 @@
       22
     ];
 
+    # AIS delegates a single /64 over PPPoE (seen 2026-10-02: "ppp0: DHCP:
+    # received delegated prefix 2405:9800:b910:1f5d::/64"). The router
+    # service hands out sub-prefixes with SubnetId=auto, so whichever VLAN
+    # interface comes up first takes the whole /64 -- on this box vlan-mgmt
+    # did, and vlan-lan logged "Couldn't find a suitable prefix. Ran out of
+    # address space": no RA prefix on lan, so clients had no global IPv6.
+    # Pin the ids: lan (where the clients are) always gets subnet 0, i.e.
+    # the entire prefix when it is a /64; mgmt asks for subnet 1, which
+    # fails harmlessly on a /64 (mgmt is reached over v4 and the meshes) and
+    # starts working unchanged if AIS ever delegates wider. Drop once
+    # cnx-network's router service exposes a per-VLAN subnet id.
+    systemd.network.networks."40-vlan-lan".dhcpPrefixDelegationConfig.SubnetId = lib.mkForce "0x0";
+    systemd.network.networks."40-vlan-mgmt".dhcpPrefixDelegationConfig.SubnetId = lib.mkForce "0x1";
+
     systemd.services.heartbeat-push = {
       description = "Heartbeat push to uptime monitor";
       serviceConfig = {