ns2: migrate to OpenTofu management

- Remove hosts/template/ (legacy template1) and give each legacy host
  its own hardware-configuration.nix copy
- Recreate ns2 using create-host with template2 base
- Add secondary DNS services (NSD + Unbound resolver)
- Configure Vault policy for shared DNS secrets
- Fix create-host IP uniqueness validator to check CIDR notation
  (prevents false positives from DNS resolver entries)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

hosts/jump/configuration.nix

@@ -3,7 +3,7 @@
 {
   imports =
     [
-      ../template/hardware-configuration.nix
+      ./hardware-configuration.nix
       ../../system
     ];