refactor: split services into reusable services/ modules

- services/{samba,avahi,audiobookshelf,containers,caddy,tailscale}.nix
- common.nix grows firewall base + timezone; hosts import what they need
- jupiter/vm/vps import service modules; drop the jupiter/services.nix monolith
- each module opens its own firewall ports; caddy/tailscale shared by hosts
- verified: jupiter/vps/vbox eval + jupiter builds, config equivalent

common.nix

@@ -37,5 +37,12 @@
 
   environment.systemPackages = with pkgs; [ vim git htop tmux curl ];
 
+  # ---- Locale / firewall base ----
+  time.timeZone = "Europe/Berlin";
   i18n.defaultLocale = "en_US.UTF-8";
+
+  # Firewall on, ssh always allowed. Service modules add their own ports
+  # (samba via openFirewall, caddy 80/443, tailscale trusts tailscale0).
+  networking.firewall.enable = true;
+  networking.firewall.allowedTCPPorts = [ 22 ];
 }