Add *arr media stack + Gitea to jupiter

- sabnzbd, prowlarr, sonarr, radarr, clonarr, seerr, cinephage, mediamanager
  services, wired into jupiter with LAN Caddy vhosts.
- Gitea: migrated the old ZimaOS docker instance's data (sqlite db, 4 repos,
  no LFS objects) into the NixOS module's default stateDir layout. HTTP via
  Caddy; git SSH on its own built-in server at :2222 (not :222 - the unpriv
  gitea user can't bind <1024).
- mediamanager-nix flake input for the mediamanager service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

services/sabnzbd.nix

@@ -0,0 +1,46 @@
+{ ... }:
+
+# SABnzbd — usenet downloader. Reuses the config migrated from the old
+# ZimaOS docker stack (servers/API key/history already set up) by pointing
+# straight at the real ini instead of generating a fresh NixOS-managed one.
+# Runs as the module's default dedicated `sabnzbd` system user — after first
+# deploy, chown the migrated config dir to it (see README/CLAUDE notes):
+#   chown -R sabnzbd:sabnzbd /mnt/data/AppData/sabnzbd/config
+{
+  services.sabnzbd = {
+    enable = true;
+    configFile = "/mnt/data/AppData/sabnzbd/config/sabnzbd.ini";
+    allowConfigWrite = true;   # real pre-existing state — let sabnzbd keep saving it
+  };
+
+  # Write access to the shared downloads dir (owned darman:users on disk).
+  users.users.sabnzbd.extraGroups = [ "users" ];
+
+  # SABnzbd hardcodes completed job folders to 0700 on every single job —
+  # independent of the ini's `umask` setting (that only covers files
+  # created during unpack, not the enclosing per-job dir). setgid on
+  # Downloads keeps the *group* as "users", but group perm bits still come
+  # back zeroed, locking out cinephage/mediamanager. Sweep it clean instead
+  # of fighting SABnzbd's own behavior.
+  systemd.services.fix-downloads-perms = {
+    description = "Fix group perms SABnzbd resets on completed downloads";
+    serviceConfig.Type = "oneshot";
+    script = ''
+      find /mnt/data/HighSeas/Downloads \
+        ! -group users -exec chgrp users {} + 2>/dev/null || true
+      find /mnt/data/HighSeas/Downloads -type d ! -perm -g+rwx \
+        -exec chmod g+rwx {} + 2>/dev/null || true
+      find /mnt/data/HighSeas/Downloads -type f ! -perm -g+rw \
+        -exec chmod g+rw {} + 2>/dev/null || true
+    '';
+  };
+
+  systemd.timers.fix-downloads-perms = {
+    description = "Periodically fix group perms under HighSeas/Downloads";
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnBootSec = "1m";
+      OnUnitActiveSec = "2m";
+    };
+  };
+}