Add *arr media stack + Gitea to jupiter

- sabnzbd, prowlarr, sonarr, radarr, clonarr, seerr, cinephage, mediamanager
  services, wired into jupiter with LAN Caddy vhosts.
- Gitea: migrated the old ZimaOS docker instance's data (sqlite db, 4 repos,
  no LFS objects) into the NixOS module's default stateDir layout. HTTP via
  Caddy; git SSH on its own built-in server at :2222 (not :222 - the unpriv
  gitea user can't bind <1024).
- mediamanager-nix flake input for the mediamanager service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

services/sonarr.nix

@@ -0,0 +1,18 @@
+{ ... }:
+
+# Sonarr — TV library manager, feeds off SABnzbd/Prowlarr. dataDir points at
+# the config migrated from the old ZimaOS docker stack (indexers/download
+# client/history already set up). Unlike prowlarr, this module uses a static
+# `sonarr` user (no DynamicUser) and only auto-chowns dataDir when it's the
+# module's own default path — since we point at a pre-existing migrated dir,
+# chown it by hand once after first deploy:
+#   chown -R sonarr:sonarr /mnt/data/AppData/sonarr/config
+{
+  services.sonarr = {
+    enable = true;
+    dataDir = "/mnt/data/AppData/sonarr/config";
+  };
+
+  # Write access to the shared library/downloads dirs (owned darman:users).
+  users.users.sonarr.extraGroups = [ "users" ];
+}