Port to NixOS: replace Helm chart with flake-based NixOS config

Replaces the Helm/k3s setup with a declarative NixOS configuration targeting
a Raspberry Pi 4. Services run as podman containers under systemd, with data
on an external HD at /mnt/data. Key components:

- flake.nix: multi-host flake with pi-main (aarch64) and a placeholder for a
  second machine
- modules/common.nix: shared system config (nix, podman, sops, SSH)
- modules/storage.nix: external HD mount with per-service subdirs
- modules/caddy.nix: Caddy with cloudflare DNS-01 ACME + authelia forward_auth
- modules/cloudflared.nix: Cloudflare tunnel for remote access
- modules/backup.nix: restic daily backups with NC maintenance mode pre-hook
- modules/services/{openldap,authelia,gitea,nextcloud,phpldapadmin}.nix: core services
- modules/services/{jellyfin,transmission}.nix: media services (disabled by default)
- secrets/: sops-nix scaffold with .sops.yaml age key config
- hosts/pi-main/: hardware config + service selection for the Pi
- PORTING.md: step-by-step migration guide (SD card → data restore → verify)

modules/services/jellyfin.nix

@@ -0,0 +1,55 @@
+{ config, lib, pkgs, homeyConfig, ... }:
+
+# Jellyfin — media server. (Deferred — enable when ready.)
+#
+# Volume layout:
+#   <dataDir>/jellyfin/config/  → /config
+#   <dataDir>/media/movies/     → /data/movies
+#   <dataDir>/media/tvshows/    → /data/tvshows
+
+let
+  cfg     = config.homey.jellyfin;
+  dataDir = config.homey.storage.mountPoint;
+  domain  = homeyConfig.domain;
+in
+{
+  options.homey.jellyfin = {
+    enable = lib.mkEnableOption "Jellyfin media server";
+
+    image = lib.mkOption {
+      type    = lib.types.str;
+      default = "docker.io/jellyfin/jellyfin:latest";
+    };
+
+    port = lib.mkOption {
+      type    = lib.types.port;
+      default = 8096;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation.oci-containers.containers.jellyfin = {
+      image = cfg.image;
+      ports = [ "127.0.0.1:${toString cfg.port}:8096" ];
+
+      environment = {
+        JELLYFIN_PublishedServerUrl = "https://jellyfin.${domain}";
+        PUID = "1000";
+        PGID = "1000";
+      };
+
+      volumes = [
+        "${dataDir}/jellyfin/config:/config"
+        "${dataDir}/media/movies:/data/movies:ro"
+        "${dataDir}/media/tvshows:/data/tvshows:ro"
+      ];
+
+      extraOptions = [ "--network=host" ];
+    };
+
+    systemd.services."podman-jellyfin" = {
+      after    = lib.mkAfter [ "mnt-data.mount" ];
+      requires = lib.mkAfter [ "mnt-data.mount" ];
+    };
+  };
+}