feat(portal): move edge proxy services from Jeeves

- move HAProxy and ACME certificate management to Portal
- route application backends to Jeeves over Tailscale
- restrict Jeeves backend ports to the Tailscale interface
- expose Gems for remote proxy access

systems/jeeves/services/jellyfin.nix

@@ -4,7 +4,7 @@ in
 {
   services.jellyfin = {
     enable = true;
-    openFirewall = true;
+    openFirewall = false;
     dataDir = "${vars.services}/jellyfin";
     cacheDir = "${vars.services}/jellyfin/cache";
   };