Reorganize services/ into category subfolders

Group service modules by category (media, network, vpn, identity,
dev, desktop) to make the growing services/ dir easier to navigate.
containers.nix stays at the top level since it's a shared backend,
not a single-category service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

hosts/neptun/secrets.nix

@@ -18,7 +18,7 @@
   # bootstrap password is different — services.zitadel.steps would render it
   # into a world-readable store path, so render a FirstInstance steps file
   # from the secret instead and point extraStepsPaths at it (see
-  # services/zitadel.nix and the pihole.env template on mercury for the same
+  # services/identity/zitadel.nix and the pihole.env template on mercury for the same
   # pattern).
   sops.secrets.zitadel_master_key = { };
   sops.secrets.zitadel_admin_password = { };
@@ -39,7 +39,7 @@
 
   # Headplane: cookie_secret_path takes a path natively (no store leak).
   # oidc.client_secret + the headscale API key are still REPLACE_ME
-  # placeholders (see services/headplane.nix) until Zitadel/headscale are
+  # placeholders (see services/vpn/headplane.nix) until Zitadel/headscale are
   # actually deployed and those get created for real.
   sops.secrets.headplane_cookie_secret = { };
   sops.secrets.headplane_oidc_client_secret = { };