validate sudo-less nix package management works.

Server should allow:
- `nix-shell ...`
- `nix flake ...`
- `nix repl`
- `devenv ...`
- `direnv ...`

Server should not allow:
- `nix store gc`
- `nixos-rebuild ...`