Reorganize services/ into category subfolders

Group service modules by category (media, network, vpn, identity,
dev, desktop) to make the growing services/ dir easier to navigate.
containers.nix stays at the top level since it's a shared backend,
not a single-category service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

services/vpn/headscale.nix

@@ -0,0 +1,25 @@
+{ ... }:
+
+# Headscale — self-hosted control server for the tailnet. Every host's
+# services/vpn/tailscale.nix points --login-server at https://vpn.mgaction.town
+# (this host). MagicDNS base_domain "hosts.mgaction.town" matches the
+# "jupiter.hosts.mgaction.town" names used in this repo's Caddy vhosts
+# (e.g. hosts/neptun/configuration.nix) — don't change one without the other.
+#
+# TLS terminates at Caddy (see the host's configuration.nix); headscale
+# itself only listens on localhost.
+{
+  services.headscale = {
+    enable = true;
+    port = 8082;   # zitadel already sits on the usual 8080 on this host
+
+    settings = {
+      server_url = "https://vpn.mgaction.town";
+
+      dns = {
+        base_domain = "hosts.mgaction.town";
+        nameservers.global = [ "1.1.1.1" "9.9.9.9" ];
+      };
+    };
+  };
+}