Add *arr media stack + Gitea to jupiter

- sabnzbd, prowlarr, sonarr, radarr, clonarr, seerr, cinephage, mediamanager
  services, wired into jupiter with LAN Caddy vhosts.
- Gitea: migrated the old ZimaOS docker instance's data (sqlite db, 4 repos,
  no LFS objects) into the NixOS module's default stateDir layout. HTTP via
  Caddy; git SSH on its own built-in server at :2222 (not :222 - the unpriv
  gitea user can't bind <1024).
- mediamanager-nix flake input for the mediamanager service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

services/seerr.nix

@@ -0,0 +1,30 @@
+{ ... }:
+
+# Seerr (formerly Jellyseerr) — request manager for Jellyfin, talks to
+# Sonarr/Radarr to fulfill requests. Fresh install, no migrated data.
+#
+# configDir is left at the module default (/var/lib/seerr) on purpose:
+# systemd's StateDirectory= auto-chown for DynamicUser only applies to that
+# exact default path, not to an arbitrary custom one (same class of issue as
+# prowlarr.nix, worked around the same way) — bind-mount AppData onto the
+# default path instead of overriding configDir, so it stays on the RAID array
+# and survives an OS-disk reinstall like every other service's data.
+#
+# Mount onto /var/lib/private/seerr, NOT the public /var/lib/seerr:
+# DynamicUser+StateDirectory keeps real data at .../private/<name> and makes
+# the public path a symlink to it; binding onto the public path turns it into
+# a mountpoint systemd then can't rename during its migrate-on-start dance
+# ("Device or resource busy", exit 238/STATE_DIRECTORY).
+{
+  services.seerr.enable = true;
+
+  fileSystems."/var/lib/private/seerr" = {
+    device = "/mnt/data/AppData/seerr";
+    fsType = "none";
+    options = [ "bind" ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /mnt/data/AppData/seerr 0755 darman users -"
+  ];
+}