refactor: split services into reusable services/ modules

- services/{samba,avahi,audiobookshelf,containers,caddy,tailscale}.nix
- common.nix grows firewall base + timezone; hosts import what they need
- jupiter/vm/vps import service modules; drop the jupiter/services.nix monolith
- each module opens its own firewall ports; caddy/tailscale shared by hosts
- verified: jupiter/vps/vbox eval + jupiter builds, config equivalent

jupiter/vm.nix

@@ -1,15 +1,23 @@
 { config, pkgs, lib, modulesPath, ... }:
 
-# VirtualBox test image. Reuses services.nix but adds console/SSH login
-# credentials so you can actually get into the VM. Disk + bootloader are
-# provided by the virtualbox-image module, so hardware-configuration.nix
-# is intentionally NOT imported here.
+# VirtualBox test image — mirrors jupiter's services (minus tailscale/sops/disk)
+# and adds console/SSH login credentials. Disk + bootloader come from the
+# virtualbox-image module, so hardware-configuration.nix is NOT imported.
 {
   imports = [
     (modulesPath + "/virtualisation/virtualbox-image.nix")
-    ./services.nix
+    ../common.nix              # shared base: user / ssh / nix / firewall
+    ../services/samba.nix
+    ../services/avahi.nix
+    ../services/audiobookshelf.nix
+    ../services/containers.nix
+    ../services/caddy.nix
   ];
 
+  networking.hostName = "jupiter";
+  networking.networkmanager.enable = true;
+  users.users.darman.extraGroups = [ "docker" ];
+
   # Allow password login for testing (real host is key-only).
   services.openssh.settings.PasswordAuthentication = lib.mkForce true;
 
@@ -26,6 +34,12 @@
     mode = "0600";
   };
 
+  # Caddy vhosts (same as the LAN host, so the proxy path is testable).
+  services.caddy.virtualHosts = {
+    "http://localhost".extraConfig = "reverse_proxy localhost:8080";
+    "http://audiobookshelf.jupiter.sol".extraConfig = "reverse_proxy localhost:8000";
+  };
+
   # Guest additions for clipboard/resize (optional).
   virtualisation.virtualbox.guest.enable = true;