Reorganize services/ into category subfolders

Group service modules by category (media, network, vpn, identity,
dev, desktop) to make the growing services/ dir easier to navigate.
containers.nix stays at the top level since it's a shared backend,
not a single-category service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

hosts/neptun/configuration.nix

@@ -7,11 +7,11 @@
     ./disk-config.nix          # disko: vda partitions + filesystems
     ./secrets.nix              # sops-nix: tailscale authkey
     ../../common.nix              # shared base: user / ssh / nix / firewall
-    ../../services/caddy.nix
-    ../../services/tailscale.nix
-    ../../services/zitadel.nix
-    ../../services/headscale.nix
-    ../../services/headplane.nix
+    ../../services/network/caddy.nix
+    ../../services/vpn/tailscale.nix
+    ../../services/identity/zitadel.nix
+    ../../services/vpn/headscale.nix
+    ../../services/vpn/headplane.nix
   ];
 
   # ---- Boot (UEFI) ----
@@ -52,7 +52,7 @@
   # TODO: port your other VPS services' vhosts here before deploying.
 
   # ---- Zitadel (identity/OIDC provider) ----
-  # Runs locally on neptun (see services/zitadel.nix); Caddy just terminates
+  # Runs locally on neptun (see services/identity/zitadel.nix); Caddy just terminates
   # TLS and proxies to it.
   services.zitadel.settings.ExternalDomain = "auth.mgaction.town";
   services.caddy.virtualHosts."auth.mgaction.town".extraConfig = ''
@@ -78,7 +78,7 @@
 
   # ---- Gitea SSH forward ----
   # Caddy only proxies HTTP; forward :2222 over the tailnet to gitea's own
-  # SSH server on jupiter (services/gitea.nix), so
+  # SSH server on jupiter (services/dev/gitea.nix), so
   # `ssh://git@git.mgaction.town:2222/...` works. Also needs a matching
   # inbound-2222 rule in netcup's edge firewall panel (not managed by Nix).
   systemd.services.gitea-ssh-forward = {

hosts/neptun/secrets.nix

@@ -18,7 +18,7 @@
   # bootstrap password is different — services.zitadel.steps would render it
   # into a world-readable store path, so render a FirstInstance steps file
   # from the secret instead and point extraStepsPaths at it (see
-  # services/zitadel.nix and the pihole.env template on mercury for the same
+  # services/identity/zitadel.nix and the pihole.env template on mercury for the same
   # pattern).
   sops.secrets.zitadel_master_key = { };
   sops.secrets.zitadel_admin_password = { };
@@ -39,7 +39,7 @@
 
   # Headplane: cookie_secret_path takes a path natively (no store leak).
   # oidc.client_secret + the headscale API key are still REPLACE_ME
-  # placeholders (see services/headplane.nix) until Zitadel/headscale are
+  # placeholders (see services/vpn/headplane.nix) until Zitadel/headscale are
   # actually deployed and those get created for real.
   sops.secrets.headplane_cookie_secret = { };
   sops.secrets.headplane_oidc_client_secret = { };