docs+e2e: document proxy-DHCP topology; default e2e bridge to LAN

Rewrites the PXE section of the ops runbook around the new proxy-DHCP
model (no dedicated bridge, coexists with UniFi/pfSense/etc.) and
swaps the e2e test's default bridge + orchestrator URL to match. The
e2e file now calls out the LAN-DHCP precondition in its header so
future-me (or CI) doesn't hang at PXE wondering why nothing answers.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

test/e2e/qemu_test.go

@@ -13,6 +13,13 @@
 //
 //	sudo go test -tags=e2e -run TestQEMUFullRun ./test/e2e/...
 //
+// Network precondition: dnsmasq runs in proxy-DHCP mode on the LAN.
+// The QEMU VM attaches to the LAN bridge (default `vmbr0`) and gets
+// its IP from the LAN's real DHCP server (e.g. UniFi) while the
+// orchestrator's dnsmasq layers on the PXE options. There must be a
+// reachable DHCP server on that bridge — tests will hang at PXE
+// otherwise. Override the bridge with VETTING_E2E_BRIDGE.
+//
 // See docs/operations.md for the manual QEMU invocation equivalent.
 package e2e
 
@@ -34,11 +41,11 @@ import (
 // Tunables — overridable via env for CI, defaults match the manual
 // setup documented in docs/operations.md.
 var (
-	bridgeName = envOr("VETTING_E2E_BRIDGE", "br-vetting")
+	bridgeName = envOr("VETTING_E2E_BRIDGE", "vmbr0")
 	liveKernel = envOr("VETTING_E2E_KERNEL", "live-image/out/vmlinuz")
 	liveInitrd = envOr("VETTING_E2E_INITRD", "live-image/out/initrd.img")
 	testMAC    = envOr("VETTING_E2E_MAC", "52:54:00:12:34:56")
-	publicURL  = envOr("VETTING_E2E_URL", "http://10.77.0.1:8080")
+	publicURL  = envOr("VETTING_E2E_URL", "http://127.0.0.1:8080")
 	// Overall budget for the run to reach Completed. Stage timeouts in
 	// the config should be tuned down for E2E to well under this.
 	runBudget = 10 * time.Minute