fix: [nomad-step-5] Reorder HCL blocks in staging.hcl and chat.hcl to match edge.hcl pattern

Align block ordering (vault → network → volumes → restart → service → task)
across all Nomad jobspecs for consistency.

nomad/jobs/chat.hcl

@@ -42,15 +42,6 @@ job "chat" {
       role = "service-chat"
     }
 
-    # ── Host volumes ─────────────────────────────────────────────────────────
-    # chat-history volume: declared in nomad/client.hcl, path
-    # /srv/disinto/chat-history on the factory box.
-    volume "chat-history" {
-      type      = "host"
-      source    = "chat-history"
-      read_only = false
-    }
-
     # ── Network ──────────────────────────────────────────────────────────────
     # External port 8080 for chat UI access (via edge proxy or direct).
     network {
@@ -60,6 +51,15 @@ job "chat" {
       }
     }
 
+    # ── Host volumes ────────────────────────────────────────────────────────
+    # chat-history volume: declared in nomad/client.hcl, path
+    # /srv/disinto/chat-history on the factory box.
+    volume "chat-history" {
+      type      = "host"
+      source    = "chat-history"
+      read_only = false
+    }
+
     # ── Restart policy ───────────────────────────────────────────────────────
     restart {
       attempts = 3

nomad/jobs/staging.hcl

@@ -25,17 +25,10 @@ job "staging" {
   group "staging" {
     count = 1
 
-    # ── Host volumes ─────────────────────────────────────────────────────────
+    # ── Vault workload identity (S5.2, issue #989) ──────────────────────────
-    # site-content volume: declared in nomad/client.hcl, path
+    # No Vault integration needed — static file server with no secrets.
-    # /srv/disinto/docker on the factory box.
-    volume "site-content" {
-      type      = "host"
-      source    = "site-content"
-      read_only = true
-    }
-
-    # No Vault integration needed — no secrets required (static file server)
 
+    # ── Network ─────────────────────────────────────────────────────────────
     # Internal service — no external port. Edge proxy routes internally.
     network {
       port "http" {
@@ -44,6 +37,15 @@ job "staging" {
       }
     }
 
+    # ── Host volumes ────────────────────────────────────────────────────────
+    # site-content volume: declared in nomad/client.hcl, path
+    # /srv/disinto/docker on the factory box.
+    volume "site-content" {
+      type      = "host"
+      source    = "site-content"
+      read_only = true
+    }
+
     restart {
       attempts = 3
       interval = "5m"