Add public visibility flags to service definitions

Mark services as public or private to control external access:
- Public: vaultwarden, forgejo, nextcloud
- Private: kanidm, jellyfin

This enables proper routing and firewall configuration based on
intended service visibility.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

shared/services.nix

@@ -8,6 +8,7 @@
       name = "kanidm";
       domain = "auth.baduhai.dev";
       host = "alexandria";
+      public = false;
       lanIP = "192.168.15.142";
       tailscaleIP = "100.76.19.50";
       port = 8443;
@@ -16,6 +17,7 @@
       name = "vaultwarden";
       domain = "pass.baduhai.dev";
       host = "alexandria";
+      public = true;
       lanIP = "192.168.15.142";
       tailscaleIP = "100.76.19.50";
       port = 8222;
@@ -24,6 +26,7 @@
       name = "forgejo";
       domain = "git.baduhai.dev";
       host = "trantor";
+      public = true;
       tailscaleIP = "100.108.5.90";
       port = 3000;
     }
@@ -31,6 +34,7 @@
       name = "nextcloud";
       domain = "cloud.baduhai.dev";
       host = "alexandria";
+      public = true;
       lanIP = "192.168.15.142";
       tailscaleIP = "100.76.19.50";
       port = 443;
@@ -39,6 +43,7 @@
       name = "jellyfin";
       domain = "jellyfin.baduhai.dev";
       host = "alexandria";
+      public = false;
       lanIP = "192.168.15.142";
       tailscaleIP = "100.76.19.50";
       port = 8096;