refactor: split services into reusable services/ modules

- services/{samba,avahi,audiobookshelf,containers,caddy,tailscale}.nix
- common.nix grows firewall base + timezone; hosts import what they need
- jupiter/vm/vps import service modules; drop the jupiter/services.nix monolith
- each module opens its own firewall ports; caddy/tailscale shared by hosts
- verified: jupiter/vps/vbox eval + jupiter builds, config equivalent

services/samba.nix

@@ -0,0 +1,53 @@
+{ pkgs, ... }:
+
+# Samba file server for the /mnt/data share + password provisioning.
+# Import on any host that should serve the NAS.
+{
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      global = {
+        "workgroup" = "WORKGROUP";
+        "server string" = "jupiter";
+        "security" = "user";
+      };
+      data = {
+        "path" = "/mnt/data";
+        "browseable" = "yes";
+        "read only" = "no";
+        "guest ok" = "no";
+        "valid users" = "darman";
+      };
+    };
+  };
+
+  # Samba keeps its own NTLM password DB, separate from the system password.
+  # `services.samba` never sets it, so logins fail until provisioned.
+  # This runs AFTER samba-smbd so its state dir (/var/lib/samba/private) exists
+  # — an activation script runs too early and smbpasswd fails to init the passdb.
+  # Reads a single-line password from the first file that exists:
+  #   Real host: /run/secrets/samba_password  (sops-nix, see secrets.nix)
+  #   VM test:   /etc/samba/smb-password       (plaintext, see vm.nix)
+  # smbpasswd prompts new + confirm, so the value is fed twice.
+  systemd.services.samba-smbpasswd = {
+    description = "Provision Samba password for darman";
+    after = [ "samba-smbd.service" ];
+    requires = [ "samba-smbd.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      for f in /run/secrets/samba_password /etc/samba/smb-password; do
+        if [ -f "$f" ]; then
+          pw=$(head -n1 "$f")
+          printf '%s\n%s\n' "$pw" "$pw" | ${pkgs.samba}/bin/smbpasswd -a -s darman
+          exit 0
+        fi
+      done
+      echo "no samba password source found" >&2
+    '';
+  };
+}