feat: tailscale via headscale (vpn.mgaction.town) + fix audiobookshelf extraGroups syntax

- services.tailscale auto-registers with headscale using a sops pre-auth key
- trust tailscale0 so LAN services are reachable over the tailnet
- fix missing semicolon on audiobookshelf extraGroups

secrets/jupiter.yaml

@@ -1,26 +1,27 @@
-samba_password: ENC[AES256_GCM,data:q1+8x+vAWdvLMklsee3CVqbByhc=,iv:CsHTBcHXAFJX0updHAlVXuTAjKNUfB+ZsMKChetjgwA=,tag:CnDlR0JmJdDcVXOXBPj/RQ==,type:str]
-darman_password: ENC[AES256_GCM,data:PRFYKMivFqAKukUshXMd7hyE7/cNMpvzCElfo3spbLiTjR2Z3XOyHd7SCHOZz9E/WL0Imjg6bMUAQEAuMD+k7tsW2WYgNIKY8pSXwOHg3joSOMXdS0qIjm0ScpJdYkQm9F2CGqX+1893HA==,iv:t/DI4gkjlYx3NGUoLrbnYnpeAudbedlU2gMw3zf6l/4=,tag:z+YInmhPXf/6HCmauS4oEg==,type:str]
+samba_password: ENC[AES256_GCM,data:K3FtKC0CrOLMyfQokmxxlyUnDPo=,iv:9bTE/S/i05LJYldOHuBuz3+g8JdTuq0ysFFgXOmfti8=,tag:77NIxy7qpHRqCmbOR83AfA==,type:str]
+darman_password: ENC[AES256_GCM,data:DOHHlM4Qdw4WgkN+/M51n2LMjJqq5MS0FeGEH8Pz3297yUZ8jBDOKRS/Tek9stC05JKEQRtn/vVVbAY0nXs20MwrsDMo+IEFXx7Ms90vVyYIYe5O5/0aQkPq84vcwGN0RW1Rj5Y3s38vWA==,iv:DAqHbvOBq7FT7ALbmBXJ0HadEGEsL8V2e7R99H5ZH0s=,tag:9XpiRFIbaZjMn59uHCOA1g==,type:str]
+tailscale_authkey: ENC[AES256_GCM,data:HY/clkraY7q5+w8gqK4LXGaWYnrZYeEqu1s8Pxq+8is=,iv:IA5PWYMAJCKTWIaYvU2cw1N51+Qhm2VFa2J+JpXZH9Y=,tag:Hgi91/tRiPasEpvfnupaIQ==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTTDlIMSt0MU1oalJveFQ5
-            QVhhS2cxeFBRTEdLbXpsbGkvY3dkR3FCN1c4ClR6dklYemtlTDcwbkZEYU5CS2ty
-            UHJ6SXlyUDVVb2dnLzZrQjVYdVhleEUKLS0tIFJFckt0ZDJsOG14TUhadURBaDd1
-            bEkwUWlnSlVhVXpScFNybzhWQkVMMEEKvEggmrMSBY/Rf1b9pKqYiY+EXxUV10pE
-            71UqOrc1o9p5XaCoyJSMjQAyEeUjzDYCbAdCV6F4uhhvhjrDye/7HQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2K0xFQmNXUGhHRW9FdEJB
+            c1BHQnJCODRGSUlMWkV1SEZlR1JpWTVpdzNBClprWmtIMEJlY3k1TE9CY3pCSlZ2
+            VDNlRFI4TUZPK2w2OU16VmlUck5IQmcKLS0tIEJJdkVzRERXTDNmWW81ZHRaeVBZ
+            SFAxTHNRdFFkTjRQK3RjemI5MW0vYTQKEMp7vk0QnhMGsn+Dfo50YNZ2jHFrbv0i
+            wU033yhkuHj3U7YHfhXYLEe8+Mq7BTVHe/dB97DYBDWmxHaL3Q/q5Q==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrNUp6d1l0ZXp6aGgzRDZw
-            MXdwKzNoU09ZWUxzOHVHZmxSOEYrQ0NsclVJCitXaXUrUlc1cHduU3dKMzFhLzdO
-            Q2ZXcDRBcUh5M3EyT2tDTjNjR0N6bVEKLS0tIC9Ybis4SkNvcXNiQ0Q0MEt3V1F4
-            aFNldCtPejFrUUc1bmxtSnJVSVorWjAKL6qjr8r27TTC3jGm14qxkXZ4dG/O5yNz
-            Bl0sZdxnncvjOaVb+q/9XNofRGkaYiAQUsuo7jJBI/MpfxHyPyz36A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSRjhjWGZDMUZlWVBBc3hp
+            RWg4U2J0UWtReUJjUFpaQ2x2MzVURmhIZ1IwCld1aGRXZ0Fvcmpmd0tZTVdoVGxh
+            QnFvMWFaK1hWbVI4R1dOckpnMW5iSzAKLS0tICtod0FTODBMTXlTUFN6Vmx1dnV5
+            c241eUJUYUY0Sm41bzRZY1Z6VnVMcjgKzsSm8DWK1cga5VKAGSu7vYuCV1/2qmzk
+            CzjSDQZTcseEXZNwuzZcfB5Mvq0BQvjOj7lGuxzuE4qwWkdJWGfVLQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt
-    lastmodified: "2026-07-12T19:34:32Z"
-    mac: ENC[AES256_GCM,data:bOOQ4yan8xAUG86TEql/Oh3kGEV02VMYeM9Acu4rCm52ytlmmF7nrbFqxQZ+oveNG3NyGri6BBuI5es7kddyzheMjexyCV4agFwQUSEsBnBf4FY+xmkvzHwsHkozJkdXZUfOfI06zIxQI2eRo4w4bNowicCHVwTTfAKFwOkDji4=,iv:DYLfyOzNRJ1ymMJRri2KVtvKWmZhX6rGkYqWh0/U77w=,tag:BfMJhetN4h4kd9fp0DDw9g==,type:str]
+    lastmodified: "2026-07-12T22:16:53Z"
+    mac: ENC[AES256_GCM,data:SfevvvHXHEiJi/9MDVgPZQOtYMCShRZw274j77C9jRZY/3HyY9ZsFBmrdNZpMbycD09F1rd1CQV3q/ZGpeViVQ/9c1wi4mYiaDzISr9Rp9os+zsA+wFuNxNIiTf88m1dolejgRhpPBJ3Obg2q9cWgKy0accSe63MnbF5JRrczJA=,iv:35cb8j5w80ctl+BzyCYCp+8i5RO9rROgGuZ/J1WYJK4=,tag:lczFd+2kVECelY/BwqfpAA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1