jupiter: keep booting when the data array is missing

After the rack move one of the RAID0 disks failed to enumerate, and jupiter
boot-looped into an emergency shell nobody could use — root is locked, so
sulogin offers a prompt with no answer, and there is no ssh from there:

  Timed out waiting for device /dev/disk/by-uuid/dadbff6f-...
  Dependency failed for /mnt/data.
  Dependency failed for /var/lib/private/prowlarr.
  Dependency failed for Local File Systems.
  local-fs.target: Job local-fs.target/start failed with result 'dependency'
  Reached target Emergency Mode.

`nofail` on /mnt/data did not help, because the prowlarr and seerr bind
mounts layered on top of it had none: without it a mount is RequiredBy
local-fs.target, so those two failed the target on the array's behalf. Give
them `nofail` too and let them fail alone. `systemd.enableEmergencyMode =
false` then keeps a bad array from costing a reachable box at all — far more
useful on a headless host than a console prompt.

Booting further is only safe if nothing quietly relocates onto the 29G eMMC,
so pin the array-backed services to the mount. systemd derives
RequiresMountsFor from a unit's own paths, which for these is somewhere under
/var/lib (eMMC) — nothing pointed immich at mediaLocation or sabnzbd at its
configFile, so with the array gone they would have started and written to the
OS disk, into directories that go invisible the moment /mnt/data mounts over
them. jellyfin, sonarr, radarr and gitea already had a real dependency and
are untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/media/prowlarr.nix

@@ -15,9 +15,21 @@
 {
   services.prowlarr.enable = true;
 
+  # `nofail` is NOT optional here: without it this bind is RequiredBy
+  # local-fs.target, so an unassembled RAID array fails that target and drops
+  # jupiter into emergency mode — which is a dead end, since root is locked and
+  # sulogin has nothing to offer on a headless box. It defeats the `nofail` on
+  # /mnt/data itself (a mount layered on the array is what actually took the
+  # target down). Let this bind fail alone instead.
   fileSystems."/var/lib/private/prowlarr" = {
     device = "/mnt/data/AppData/prowlarr/config";
     fsType = "none";
-    options = [ "bind" ];
+    options = [ "bind" "nofail" ];
   };
+
+  # systemd derives RequiresMountsFor from the unit's own paths, which here is
+  # only /var/lib/prowlarr on the eMMC — so without this prowlarr starts happily
+  # with the array absent and writes its state onto the 29G OS disk. Pin it to
+  # the array so it fails loudly instead.
+  systemd.services.prowlarr.unitConfig.RequiresMountsFor = [ "/mnt/data" ];
 }