feat(networking): migrate host services from ZeroTier to Tailscale

- replace legacy IP addresses with Tailscale MagicDNS names
- route Prometheus scraping and exporter firewall access through Tailscale
- wait for Tailscale before starting Prometheus
- restrict service UI ports to the Tailscale interface
- update PostgreSQL and Transmission access rules
- remove Jeeves ZeroTier configuration and Docker host overrides

systems/jeeves/syncthing.nix

@@ -2,11 +2,11 @@ let
   vars = import ./vars.nix;
 in
 {
-  networking.firewall.allowedTCPPorts = [ 8384 ];
+  networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 8384 ];
 
   services.syncthing = {
     overrideFolders = false;
-    guiAddress = "192.168.90.40:8384";
+    guiAddress = "0.0.0.0:8384";
     settings = {
       devices.davids-server.id = "7GXTDGR-AOXFW2O-K6J7NM3-XYZNRRW-AKHAFWM-GBOWUPQ-OA6JIWD-ER7RDQL"; # cspell:disable-line
       folders = {