Add *arr media stack + Gitea to jupiter

- sabnzbd, prowlarr, sonarr, radarr, clonarr, seerr, cinephage, mediamanager
  services, wired into jupiter with LAN Caddy vhosts.
- Gitea: migrated the old ZimaOS docker instance's data (sqlite db, 4 repos,
  no LFS objects) into the NixOS module's default stateDir layout. HTTP via
  Caddy; git SSH on its own built-in server at :2222 (not :222 - the unpriv
  gitea user can't bind <1024).
- mediamanager-nix flake input for the mediamanager service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

services/containers.nix

@@ -1,7 +1,8 @@
 { ... }:
 
 # Podman (Docker-compatible) + declarative OCI containers.
-# Copy the whoami block per app; publish ports and mount /mnt/data volumes.
+# Add containers under virtualisation.oci-containers.containers; publish
+# ports and mount /mnt/data volumes as needed.
 {
   virtualisation.podman = {
     enable = true;
@@ -9,14 +10,5 @@
     defaultNetwork.settings.dns_enabled = true;
   };
 
-  virtualisation.oci-containers = {
-    backend = "podman";
-    containers = {
-      whoami = {
-        image = "traefik/whoami:latest";
-        ports = [ "8080:80" ];
-        autoStart = true;
-      };
-    };
-  };
+  virtualisation.oci-containers.backend = "podman";
 }