nixos: services: jellyfin: loosen umask

I just noticed that all the metadata files Jellyfin stores have very
restrictive ACLs.

The whole point of the `media` group is to make my HTPC eco-system work
together. In particular this should allow Sonarr and friends to delete
folders without manual intervention.

modules/nixos/services/jellyfin/default.nix

@@ -17,6 +17,13 @@ in
     # Set-up media group
     users.groups.media = { };
 
+    systemd.services.jellyfin = {
+      serviceConfig = {
+        # Loose umask to make Jellyfin metadata more broadly readable
+        UMask = lib.mkForce "0002";
+      };
+    };
+
     my.services.nginx.virtualHosts = {
       jellyfin = {
         port = 8096;