fix(nix): use pnpm.fetchDeps derivation and add flake lock

nix/package.nix

@@ -2,13 +2,13 @@
 let
   lib = pkgs.lib;
 in
-pkgs.buildPnpmPackage rec {
+pkgs.stdenv.mkDerivation rec {
   pname = "flynn";
   version = "0.1.0";
 
   # Keep the source small and deterministic for Nix builds.
   src = lib.cleanSourceWith {
-    src = ./.;
+    src = ../.;
     filter =
       path: type:
       let
@@ -23,15 +23,21 @@ pkgs.buildPnpmPackage rec {
       );
   };
 
-  pnpmLock = ./pnpm-lock.yaml;
+  pnpmDeps = pkgs.pnpm.fetchDeps {
+    inherit pname version src;
 
-  # NOTE: Update this hash after the first `nix build` by copying the
+    # NOTE: Update this hash after the first `nix build` by copying the
   # "got: sha256-..." value from the error message.
-  pnpmDepsHash = lib.fakeHash;
+    hash = lib.fakeHash;
+  };
 
   nativeBuildInputs = [
+    pkgs.nodejs_22
+    pkgs.pnpm.configHook
     pkgs.makeWrapper
     pkgs.python3
+    pkgs.gnumake
+    pkgs.gcc
     pkgs.pkg-config
   ];
 
@@ -65,4 +71,3 @@ pkgs.buildPnpmPackage rec {
     mainProgram = "flynn";
   };
 }
-