feat: tailscale via headscale (vpn.mgaction.town) + fix audiobookshelf extraGroups syntax

- services.tailscale auto-registers with headscale using a sops pre-auth key
- trust tailscale0 so LAN services are reachable over the tailnet
- fix missing semicolon on audiobookshelf extraGroups

jupiter/configuration.nix

@@ -39,4 +39,19 @@
     fsType = "ext4";
     options = [ "nofail" ];  # don't block boot if the array is degraded/absent
   };
+
+  # ---- Tailscale (via self-hosted headscale) ----
+  # Auto-registers on boot using a headscale pre-auth key from sops.
+  # Generate the key on the headscale server, e.g.:
+  #   headscale preauthkeys create --user <user> --expiration 1h
+  # then put it in secrets/jupiter.yaml (./edit_secrets, key: tailscale_authkey).
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;                       # UDP 41641 for direct connections
+    authKeyFile = config.sops.secrets.tailscale_authkey.path;
+    extraUpFlags = [ "--login-server=https://vpn.mgaction.town" ];
+  };
+  # Reach jupiter's services (ssh, samba, audiobookshelf) over the tailnet
+  # without opening those ports on the LAN.
+  networking.firewall.trustedInterfaces = [ "tailscale0" ];
 }