ha: retire home-assistant-iot LoadBalancer at 10.2.30.80

All Shellies (Gen1 and Gen2) are on MQTT to mosquitto-iot, so nothing
on v30iot needs the L2-announced HTTP entry point at 10.2.30.80 any
more. ha.renner.uno (10.2.99.87, bgp-pool, ETP=Local) covers the
remaining LAN-side HA HTTP traffic. Removing this also eliminates the
Cilium L2-lease-on-wrong-node trap that broke TTS earlier today.

iot-pool LoadBalancerIPPool and the iot CiliumL2AnnouncementPolicy in
infrastructure/post-crds/cilium-l2.yaml are now orphaned (no Services
match their selectors). Left in place: the macvlan NetworkAttachments
for shelly-manager, matter-server, and otbr still hand-allocate IPs
from the 10.2.30.0/24 block and reference iot-pool in comments. Pool
cleanup is a separate decision.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

kubernetes/apps/home-assistant/iot-service.yaml

@@ -1,29 +0,0 @@
----
-# Fixed IoT-VLAN IP for HA — for IoT devices that can't speak DNS or
-# traverse the K8s ingress (legacy Shelly Gen1, dumb sensors with hard-
-# coded server IPs, etc.). Cluster traffic continues to use the
-# regular ClusterIP `home-assistant` Service in service.yaml.
-#
-# IP must come from the iot-pool (10.2.30.80-89) and is requested via
-# lbipam.cilium.io/ips. The matching CiliumL2AnnouncementPolicy `iot`
-# only binds Services that also carry `iot-vlan: "true"`, and only
-# announces from k8s-edge (the only node with a v30iot NIC).
-apiVersion: v1
-kind: Service
-metadata:
-  name: home-assistant-iot
-  namespace: home-assistant
-  labels:
-    app.kubernetes.io/name: home-assistant
-    iot-vlan: "true"
-  annotations:
-    lbipam.cilium.io/ips: "10.2.30.80"
-spec:
-  type: LoadBalancer
-  externalTrafficPolicy: Local
-  selector:
-    app.kubernetes.io/name: home-assistant
-  ports:
-    - name: http
-      port: 8123
-      targetPort: 8123

kubernetes/apps/home-assistant/kustomization.yaml

@@ -6,7 +6,6 @@ resources:
   - pvcs.yaml
   - deployment.yaml
   - service.yaml
-  - iot-service.yaml
   - bgp-service.yaml
   - vscode-service.yaml
   - ingress.yaml