Until now, we were leaving services "enabled"
(symlinks in /etc/systemd/system/multi-user.target.wants/).

We clean these up now. Broken symlinks may still exist in older
installations that enabled/disabled services. We're not taking care
to fix these up. It's just a cosmetic defect anyway.

fix nginx boot loop

We'll be adding `.timer` units later on, so it's good to be
more explicit.

No migration steps should be required.