Add *arr media stack + Gitea to jupiter

- sabnzbd, prowlarr, sonarr, radarr, clonarr, seerr, cinephage, mediamanager
  services, wired into jupiter with LAN Caddy vhosts.
- Gitea: migrated the old ZimaOS docker instance's data (sqlite db, 4 repos,
  no LFS objects) into the NixOS module's default stateDir layout. HTTP via
  Caddy; git SSH on its own built-in server at :2222 (not :222 - the unpriv
  gitea user can't bind <1024).
- mediamanager-nix flake input for the mediamanager service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

services/prowlarr.nix

@@ -0,0 +1,30 @@
+{ ... }:
+
+# Prowlarr — indexer manager (usenet + torrent), feeds SABnzbd/MediaManager.
+# services.prowlarr.dataDir is left at its module default (/var/lib/prowlarr)
+# on purpose: passing a *custom* dataDir makes the upstream module bind-mount
+# it and force-reset the outer dir to 0700 root:root via a tmpfiles rule on
+# every boot (nixos/modules/services/misc/servarr/prowlarr.nix) — that stomps
+# DynamicUser's access to pre-existing content and causes intermittent
+# "unable to open database file".
+#
+# Instead we bind-mount the real (migrated-from-ZimaOS) config dir straight
+# onto the module's own default path, so prowlarr never sees a "custom"
+# dataDir and none of that logic triggers. DynamicUser+StateDirectory then
+# recursively chowns the pre-existing content to its assigned uid on first
+# activation, same as it does for a fresh install — no manual chown needed.
+#
+# Mount onto /var/lib/private/prowlarr, NOT the public /var/lib/prowlarr:
+# DynamicUser+StateDirectory keeps real data at .../private/<name> and makes
+# the public path a symlink to it; binding onto the public path turns it into
+# a mountpoint systemd then can't rename during its migrate-on-start dance
+# ("Device or resource busy", exit 238/STATE_DIRECTORY).
+{
+  services.prowlarr.enable = true;
+
+  fileSystems."/var/lib/private/prowlarr" = {
+    device = "/mnt/data/AppData/prowlarr/config";
+    fsType = "none";
+    options = [ "bind" ];
+  };
+}