Reorganize services/ into category subfolders

Group service modules by category (media, network, vpn, identity,
dev, desktop) to make the growing services/ dir easier to navigate.
containers.nix stays at the top level since it's a shared backend,
not a single-category service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

services/vpn/headplane.nix

@@ -1,6 +1,6 @@
 { config, ... }:
 
-# Headplane — web UI for headscale (services/headscale.nix; must be enabled
+# Headplane — web UI for headscale (services/vpn/headscale.nix; must be enabled
 # first). Runs as headscale's own OS user so it can restart headscale when
 # settings change from the UI.
 #
@@ -9,7 +9,7 @@
 # /admin prefix — Headplane appends that itself, including for the OIDC
 # callback.
 #
-# Auth is Zitadel (services/zitadel.nix) via OIDC. client_id, client_secret,
+# Auth is Zitadel (services/identity/zitadel.nix) via OIDC. client_id, client_secret,
 # and the headscale API key can't be known until Zitadel/headscale are
 # actually deployed, so they're placeholders below; direct API-key login
 # still works as a fallback until then. Once live:

services/vpn/headscale.nix

@@ -1,7 +1,7 @@
 { ... }:
 
 # Headscale — self-hosted control server for the tailnet. Every host's
-# services/tailscale.nix points --login-server at https://vpn.mgaction.town
+# services/vpn/tailscale.nix points --login-server at https://vpn.mgaction.town
 # (this host). MagicDNS base_domain "hosts.mgaction.town" matches the
 # "jupiter.hosts.mgaction.town" names used in this repo's Caddy vhosts
 # (e.g. hosts/neptun/configuration.nix) — don't change one without the other.