feat(audiobookshelf): bind 0.0.0.0 so it's reachable over tailscale (VPS proxy)

jupiter/services.nix

@@ -108,9 +108,11 @@
   # dirs on the RAID (chown/chmod or add it to the owning group as needed).
   services.audiobookshelf = {
     enable = true;
-    host = "127.0.0.1";
+    host = "0.0.0.0";   # reachable over tailscale0 (trusted) + localhost
     port = 8000;
-    # openFirewall stays off — access is via the caddy reverse proxy.
+    # openFirewall stays OFF: :8000 is blocked on the LAN, but tailscale0 is a
+    # trusted interface, so the VPS reaches it via jupiter.hosts.mgaction.town:8000.
+    # Local caddy (below) still serves LAN clients via localhost:8000.
   };
 
   users.users.audiobookshelf.extraGroups = [ "users" ];