refactor: split services into reusable services/ modules

- services/{samba,avahi,audiobookshelf,containers,caddy,tailscale}.nix
- common.nix grows firewall base + timezone; hosts import what they need
- jupiter/vm/vps import service modules; drop the jupiter/services.nix monolith
- each module opens its own firewall ports; caddy/tailscale shared by hosts
- verified: jupiter/vps/vbox eval + jupiter builds, config equivalent

services/audiobookshelf.nix

@@ -0,0 +1,16 @@
+{ ... }:
+
+# Audiobookshelf audiobook/podcast server.
+# Listens on all interfaces: :8000 stays closed on the LAN (no openFirewall),
+# but reachable over the trusted tailscale0 interface and via localhost (caddy).
+# Library/media paths are set in the web UI — point them at /mnt/data/...
+# Runs as user `audiobookshelf`; added to `users` so it can read group-owned
+# library dirs on the RAID.
+{
+  services.audiobookshelf = {
+    enable = true;
+    host = "0.0.0.0";
+    port = 8000;
+  };
+  users.users.audiobookshelf.extraGroups = [ "users" ];
+}