Add *arr media stack + Gitea to jupiter

- sabnzbd, prowlarr, sonarr, radarr, clonarr, seerr, cinephage, mediamanager
  services, wired into jupiter with LAN Caddy vhosts.
- Gitea: migrated the old ZimaOS docker instance's data (sqlite db, 4 repos,
  no LFS objects) into the NixOS module's default stateDir layout. HTTP via
  Caddy; git SSH on its own built-in server at :2222 (not :222 - the unpriv
  gitea user can't bind <1024).
- mediamanager-nix flake input for the mediamanager service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

services/gitea.nix

@@ -0,0 +1,48 @@
+{ ... }:
+
+# Gitea — self-hosted git. stateDir/repositories were migrated from the old
+# ZimaOS docker instance (single user/org "darman", sqlite db, 4 repos, no
+# LFS objects yet) into stateDir's default layout (data/gitea.db,
+# data/{indexers,avatars,sessions,...}, repositories/), so no import step is
+# needed on first boot — NixOS just needs to chown it to the gitea user
+# (see below).
+#
+# HTTP is reverse-proxied through Caddy (see hosts/jupiter/configuration.nix
+# for the vhost). SSH clone/push uses gitea's own built-in SSH server on
+# :2222, kept separate from the host's OpenSSH on :22. NOT :222 (the old
+# docker setup's external port) — gitea runs as the unpriv "gitea" user with
+# an empty capability set, so it can't bind <1024: "listen tcp :222: bind:
+# permission denied".
+#
+# After first deploy, fix ownership of the migrated data (it currently
+# belongs to darman:users from the CIFS copy):
+#   chown -R gitea:gitea /mnt/data/AppData/gitea
+{
+  services.gitea = {
+    enable = true;
+    stateDir = "/mnt/data/AppData/gitea";
+    lfs.enable = true;
+
+    settings = {
+      repository = {
+        DEFAULT_BRANCH = "master";
+      };
+      server = {
+        DOMAIN = "git.mgaction.town";
+        SSH_DOMAIN = "git.mgaction.town";
+        ROOT_URL = "http://git.mgaction.town/";
+        HTTP_PORT = 3000;
+        START_SSH_SERVER = true;
+        SSH_PORT = 2222;
+        SSH_LISTEN_PORT = 2222;
+      };
+      service = {
+        DISABLE_REGISTRATION = true;
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 2222 ];
+
+  users.users.gitea.extraGroups = [ "users" ];
+}