guacamole: consolidate nodeSelector — use rke2-server for guacd too

Previous commit 90deacd raced with the user's f0733ff (which had
already pinned the guacamole web Deployment to rke2-server for the
NFS ACL). That left two nodeSelector blocks on the web pod and an
inconsistent agent2 pin on guacd. Align both pods to rke2-server.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/guacamole/guacamole.yaml

@@ -177,13 +177,12 @@ spec:
         app: guacd
     spec:
       serviceAccountName: guacd-exec
-      # Pinned to rke2-agent2: Synology NFS export at /volume1/kubernetes
-      # currently grants mount permission only to 10.0.56.13. guacd + guacamole
-      # web share the NFS-backed /var/lib/guacamole/recordings, so co-locating
-      # is also efficient. Remove this when the Synology NFS ACL opens to all
-      # cluster nodes.
+      # Pinned to rke2-server: matches the guacamole web nodeSelector so both
+      # pods co-locate on the only node currently in the Synology NFS export
+      # ACL for /volume1/kubernetes. Open the ACL to all cluster nodes to
+      # remove this constraint.
       nodeSelector:
-        kubernetes.io/hostname: rke2-agent2
+        kubernetes.io/hostname: rke2-server
       containers:
         - name: guacd
           image: guacamole/guacd:latest
@@ -263,9 +262,6 @@ spec:
       labels:
         app: guacamole
     spec:
-      # Pinned to rke2-agent2: same reason as guacd (NFS recordings mount).
-      nodeSelector:
-        kubernetes.io/hostname: rke2-agent2
       containers:
         - name: guacamole
           image: guacamole/guacamole:latest