feat(nix): add Nix flake for building and deploying Spacebot

[skulldogged]

Summary

Add Nix flake support for reproducible builds and NixOS deployment. Includes package definitions and a NixOS module for declarative service configuration.

Changes

• Add flake.nix with two package variants:
  • spacebot (slim): Core functionality
  • spacebot-full: Includes Chromium for browser automation
• Add NixOS module (nix/module.nix) with services.spacebot options
• Frontend built separately and embedded into binary via SPACEBOT_SKIP_FRONTEND_BUILD
• Dev shell with Rust toolchain, bun, and build dependencies
• Support for secret injection via environmentFile (sops-nix/agenix compatible)

Test plan

• nix flake check passes
• nix build .#spacebot and nix build .#spacebot-full succeed
• Verify NixOS module deploys and web UI is accessible on first run

Example usage

services.spacebot = {
  enable = true;
  variant = "full";
  openFirewall = true;
};

[skulldogged]

BTW, this won't work out of the box - after merging, a maintainer will need to rm -rf interface/node_modules; rm interface/package-lock.json; npm --prefix interface install to regen the package-lock.json, commit, then it should all be good. (This is to avoid having to include a huge package-lock change in this PR)

Switched to using Bun instead of npm in the latest commits. Lockfile changes are no longer needed, this should work as soon as it's merged in now with no further action.