refactor: split services into reusable services/ modules

- services/{samba,avahi,audiobookshelf,containers,caddy,tailscale}.nix
- common.nix grows firewall base + timezone; hosts import what they need
- jupiter/vm/vps import service modules; drop the jupiter/services.nix monolith
- each module opens its own firewall ports; caddy/tailscale shared by hosts
- verified: jupiter/vps/vbox eval + jupiter builds, config equivalent

services/containers.nix

@@ -0,0 +1,22 @@
+{ ... }:
+
+# Podman (Docker-compatible) + declarative OCI containers.
+# Copy the whoami block per app; publish ports and mount /mnt/data volumes.
+{
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+    defaultNetwork.settings.dns_enabled = true;
+  };
+
+  virtualisation.oci-containers = {
+    backend = "podman";
+    containers = {
+      whoami = {
+        image = "traefik/whoami:latest";
+        ports = [ "8080:80" ];
+        autoStart = true;
+      };
+    };
+  };
+}