Reorganize services/ into category subfolders

Group service modules by category (media, network, vpn, identity,
dev, desktop) to make the growing services/ dir easier to navigate.
containers.nix stays at the top level since it's a shared backend,
not a single-category service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

hosts/neptun/configuration.nix

@@ -7,11 +7,11 @@
     ./disk-config.nix          # disko: vda partitions + filesystems
     ./secrets.nix              # sops-nix: tailscale authkey
     ../../common.nix              # shared base: user / ssh / nix / firewall
-    ../../services/caddy.nix
-    ../../services/tailscale.nix
-    ../../services/zitadel.nix
-    ../../services/headscale.nix
-    ../../services/headplane.nix
+    ../../services/network/caddy.nix
+    ../../services/vpn/tailscale.nix
+    ../../services/identity/zitadel.nix
+    ../../services/vpn/headscale.nix
+    ../../services/vpn/headplane.nix
   ];
 
   # ---- Boot (UEFI) ----
@@ -52,7 +52,7 @@
   # TODO: port your other VPS services' vhosts here before deploying.
 
   # ---- Zitadel (identity/OIDC provider) ----
-  # Runs locally on neptun (see services/zitadel.nix); Caddy just terminates
+  # Runs locally on neptun (see services/identity/zitadel.nix); Caddy just terminates
   # TLS and proxies to it.
   services.zitadel.settings.ExternalDomain = "auth.mgaction.town";
   services.caddy.virtualHosts."auth.mgaction.town".extraConfig = ''
@@ -78,7 +78,7 @@
 
   # ---- Gitea SSH forward ----
   # Caddy only proxies HTTP; forward :2222 over the tailnet to gitea's own
-  # SSH server on jupiter (services/gitea.nix), so
+  # SSH server on jupiter (services/dev/gitea.nix), so
   # `ssh://git@git.mgaction.town:2222/...` works. Also needs a matching
   # inbound-2222 rule in netcup's edge firewall panel (not managed by Nix).
   systemd.services.gitea-ssh-forward = {