Reorganize services/ into category subfolders

Group service modules by category (media, network, vpn, identity,
dev, desktop) to make the growing services/ dir easier to navigate.
containers.nix stays at the top level since it's a shared backend,
not a single-category service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

services/media/prowlarr.nix

@@ -0,0 +1,23 @@
+{ ... }:
+
+# Prowlarr — indexer manager (usenet + torrent), feeds SABnzbd/MediaManager.
+# dataDir is left at the module default: a *custom* dataDir makes the
+# upstream module force-reset it to 0700 root:root on every boot, stomping
+# DynamicUser's access ("unable to open database file"). Instead bind-mount
+# the real (migrated-from-ZimaOS) config dir onto the default path, so
+# DynamicUser+StateDirectory chowns it on first activation like a fresh
+# install — no manual chown needed.
+#
+# Mount onto /var/lib/private/prowlarr, NOT the public /var/lib/prowlarr:
+# StateDirectory symlinks the public path to .../private/<name>; binding
+# onto the public path itself blocks systemd's migrate-on-start rename
+# ("Device or resource busy", exit 238/STATE_DIRECTORY).
+{
+  services.prowlarr.enable = true;
+
+  fileSystems."/var/lib/private/prowlarr" = {
+    device = "/mnt/data/AppData/prowlarr/config";
+    fsType = "none";
+    options = [ "bind" ];
+  };
+}