Add NixOS flake with dev shell, package, and systemd module

Includes nix develop shell (node, pg, vips), buildNpmPackage derivation,
and a NixOS module for deploying as a systemd service with hardening,
dedicated user, and configurable secrets via environmentFile.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitignore

@@ -5,3 +5,5 @@ build
 static/uploads/**
 !static/uploads/.gitkeep
 *.db
+result
+.direnv