refactor: split services into reusable services/ modules

- services/{samba,avahi,audiobookshelf,containers,caddy,tailscale}.nix
- common.nix grows firewall base + timezone; hosts import what they need
- jupiter/vm/vps import service modules; drop the jupiter/services.nix monolith
- each module opens its own firewall ports; caddy/tailscale shared by hosts
- verified: jupiter/vps/vbox eval + jupiter builds, config equivalent

services/tailscale.nix

@@ -0,0 +1,16 @@
+{ config, ... }:
+
+# Tailscale node joined to the self-hosted headscale control server.
+# Auto-registers on boot from a sops pre-auth key. Requires the importing host
+# to declare `sops.secrets.tailscale_authkey` (see each host's secrets.nix).
+# Not for the VM (no sops).
+{
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;                       # UDP 41641 for direct connections
+    authKeyFile = config.sops.secrets.tailscale_authkey.path;
+    extraUpFlags = [ "--login-server=https://vpn.mgaction.town" ];
+  };
+  # Reach the host's services over the tailnet without opening LAN ports.
+  networking.firewall.trustedInterfaces = [ "tailscale0" ];
+}