feat(jeeves): centralize firewall configuration

- split networking into interface and firewall modules
- define named service ports in one location
- remove scattered service-level firewall rules

systems/jeeves/services/gitea.nix

@@ -2,10 +2,6 @@ let
   vars = import ../vars.nix;
 in
 {
-  networking.firewall.allowedTCPPorts = [
-    2223
-  ];
-
   services.gitea = {
     enable = true;
     appName = "TMM Workshop";

systems/jeeves/services/grafana.nix

@@ -6,8 +6,6 @@ let
   grafanaDataDir = "${vars.services}/grafana";
 in
 {
-  networking.firewall.allowedTCPPorts = [ 3000 ];
-
   services.grafana = {
     enable = true;
     dataDir = grafanaDataDir;

systems/jeeves/services/jellyfin.nix

@@ -4,7 +4,6 @@ in
 {
   services.jellyfin = {
     enable = true;
-    openFirewall = false;
     dataDir = "${vars.services}/jellyfin";
     cacheDir = "${vars.services}/jellyfin/cache";
   };

systems/jeeves/services/llms.nix

@@ -38,7 +38,6 @@ in
       "qwen3.5:35b"
     ];
     modelsDir = vars.ollama;
-    openFirewall = true;
   };
   systemd.services = {
     ollama.serviceConfig = {

systems/jeeves/services/nix_serve.nix

@@ -7,6 +7,5 @@ in
     package = pkgs.nix-serve-ng;
     enable = true;
     secretKeyFile = "${vars.secrets}/services/nix-cache/cache-priv-key.pem";
-    openFirewall = false;
   };
 }

systems/jeeves/services/open_webui.nix

@@ -2,7 +2,6 @@
   services.open-webui = {
     enable = true;
     host = "0.0.0.0";
-    openFirewall = true;
     environment = {
       ANONYMIZED_TELEMETRY = "False";
       DO_NOT_TRACK = "True";

systems/jeeves/services/postgress.nix

@@ -3,8 +3,6 @@ let
   vars = import ../vars.nix;
 in
 {
-  networking.firewall.allowedTCPPorts = [ 5432 ];
-
   # Symlink pg_wal to a ZFS dataset on the special (metadata) vdev for fast WAL writes
   # this is required for systemd sandboxing
   systemd.services.postgresql.serviceConfig.ReadWritePaths = [ "/zfs/media/database/postgres-wal" ];