feat: tailscale via headscale (vpn.mgaction.town) + fix audiobookshelf extraGroups syntax

- services.tailscale auto-registers with headscale using a sops pre-auth key
- trust tailscale0 so LAN services are reachable over the tailnet
- fix missing semicolon on audiobookshelf extraGroups

jupiter/services.nix

@@ -113,6 +113,8 @@
     # openFirewall stays off — access is via the caddy reverse proxy.
   };
 
+  users.users.audiobookshelf.extraGroups = [ "users" ];
+
   # ---- Containers ----
   virtualisation.podman = {
     enable = true;
@@ -144,7 +146,7 @@
     # Reach at http://audiobookshelf.sol — add a pihole local-DNS record
     # audiobookshelf.sol -> jupiter's IP. (Or browse jupiter.sol directly if you
     # set services.audiobookshelf.host = "0.0.0.0" + openFirewall instead.)
-    virtualHosts."http://audiobookshelf.sol".extraConfig = ''
+    virtualHosts."http://audiobookshelf.jupiter.sol".extraConfig = ''
       reverse_proxy localhost:8000
     '';
   };