Reorganize services/ into category subfolders

Group service modules by category (media, network, vpn, identity,
dev, desktop) to make the growing services/ dir easier to navigate.
containers.nix stays at the top level since it's a shared backend,
not a single-category service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

services/media/jellyfin.nix

@@ -0,0 +1,18 @@
+{ lib, ... }:
+
+{
+  services.jellyfin = {
+    enable = true;
+    dataDir = "/mnt/data/AppData/jellyfin";
+    cacheDir = "/mnt/data/AppData/jellyfin/cache";
+  };
+  users.users.jellyfin.extraGroups = [ "users" ];
+
+  # The upstream module hardcodes UMask=0077 — root cause of jellyfin writing
+  # trickplay thumbnails into stray new show folders it invented itself,
+  # owned jellyfin:jellyfin 700, invisible to every other service sharing
+  # the library (cinephage, mediamanager, ...). New files/dirs it creates
+  # from here on inherit group "users" (library roots are setgid, see the
+  # one-time chmod g+s done by hand) and stay group-writable.
+  systemd.services.jellyfin.serviceConfig.UMask = lib.mkForce "0002";
+}