feat(jeeves): centralize firewall configuration

- split networking into interface and firewall modules
- define named service ports in one location
- remove scattered service-level firewall rules

systems/jeeves/networking/firewall.nix

@@ -0,0 +1,47 @@
+let
+  ports = {
+    audiobookshelf = 8000;
+    ebook_searcher = 8070;
+    gems = 8002;
+    gitea_http = 6443;
+    gitea_ssh = 2223;
+    grafana = 3000;
+    jellyfin_http = 8096;
+    nix_binary_cache = 5000;
+    nornsight = 8001;
+    ollama = 11434;
+    open_webui = 8080;
+    postgresql = 5432;
+    share = 8091;
+    signal_cli = 8989;
+    syncthing = 8384;
+  };
+in
+{
+  networking.firewall = {
+    enable = true;
+    interfaces.br-nix-builder = {
+      allowedTCPPorts = [ ];
+      allowedUDPPorts = [ ];
+    };
+    interfaces.tailscale0.allowedTCPPorts = [
+      ports.audiobookshelf
+      ports.gems
+      ports.jellyfin_http
+      ports.nix_binary_cache
+      ports.nornsight
+      ports.share
+    ];
+    allowedTCPPorts = [
+      ports.ebook_searcher
+      ports.gitea_http
+      ports.gitea_ssh
+      ports.grafana
+      ports.ollama
+      ports.open_webui
+      ports.postgresql
+      ports.signal_cli
+      ports.syncthing
+    ];
+  };
+}