Move Hacklab NAT IP from 185.34.62.1 to 185.34.62.2 (to allow router separation).
Deploy new border router on PC server hardware, running BSDRP.
Deploy new internal router on PC server hardware, running pfSense.
Retain Mikrotik as a backup border router.
Move shelf-mounted routers and RPis from mid-rack to top-rack (co-locate behind the HUBS fibre).