Add *arr media stack + Gitea to jupiter

- sabnzbd, prowlarr, sonarr, radarr, clonarr, seerr, cinephage, mediamanager
  services, wired into jupiter with LAN Caddy vhosts.
- Gitea: migrated the old ZimaOS docker instance's data (sqlite db, 4 repos,
  no LFS objects) into the NixOS module's default stateDir layout. HTTP via
  Caddy; git SSH on its own built-in server at :2222 (not :222 - the unpriv
  gitea user can't bind <1024).
- mediamanager-nix flake input for the mediamanager service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

services/jellyfin.nix

@@ -1,16 +1,18 @@
-{ ... }:
+{ lib, ... }:
 
-# Audiobookshelf audiobook/podcast server.
-# Listens on all interfaces: :8000 stays closed on the LAN (no openFirewall),
-# but reachable over the trusted tailscale0 interface and via localhost (caddy).
-# Library/media paths are set in the web UI — point them at /mnt/data/...
-# Runs as user `audiobookshelf`; added to `users` so it can read group-owned
-# library dirs on the RAID.
 {
   services.jellyfin = {
     enable = true;
     dataDir = "/mnt/data/AppData/jellyfin";
-    cacheDir = "${cfg.dataDir}/cache";
+    cacheDir = "/mnt/data/AppData/jellyfin/cache";
   };
   users.users.jellyfin.extraGroups = [ "users" ];
+
+  # The upstream module hardcodes UMask=0077 — root cause of jellyfin writing
+  # trickplay thumbnails into stray new show folders it invented itself,
+  # owned jellyfin:jellyfin 700, invisible to every other service sharing
+  # the library (cinephage, mediamanager, ...). New files/dirs it creates
+  # from here on inherit group "users" (library roots are setgid, see the
+  # one-time chmod g+s done by hand) and stay group-writable.
+  systemd.services.jellyfin.serviceConfig.UMask = lib.mkForce "0002";
 }