feat(nix): add Nix flake for building and deploying Spacebot

[skulldogged]

Summary

Add Nix flake support for reproducible builds and NixOS deployment. Includes package definitions and a NixOS module for declarative service configuration.

Changes

• Add flake.nix with two package variants:
  • spacebot (slim): Core functionality
  • spacebot-full: Includes Chromium for browser automation
• Add NixOS module (nix/module.nix) with services.spacebot options
• Frontend built separately and embedded into binary via SPACEBOT_SKIP_FRONTEND_BUILD
• Dev shell with Rust toolchain, bun, and build dependencies
• Support for secret injection via environmentFile (sops-nix/agenix compatible)

Test plan

• nix flake check passes
• nix build .#spacebot and nix build .#spacebot-full succeed
• Verify NixOS module deploys and web UI is accessible on first run

Example usage

services.spacebot = {
  enable = true;
  variant = "full";
  openFirewall = true;
};

[skulldogged]

BTW, this won't work out of the box - after merging, a maintainer will need to rm -rf interface/node_modules; rm interface/package-lock.json; npm --prefix interface install to regen the package-lock.json, commit, and then I'll need to update the npm deps hash in a new PR. After that it should all be good. (This is to avoid having to include a huge package-lock change in this PR)