feat(deploy): add Nix flake + NixOS module

docs/deployment/NIX.md

@@ -0,0 +1,58 @@
+# Nix Deployment
+
+This repo ships a Nix flake with:
+
+- `nix run` support (runs `flynn`)
+- `nix develop` dev shell (Node 22 + pnpm)
+- A package that builds `dist/` and preserves `dist/gateway/ui` adjacency
+- An optional NixOS module (`services.flynn`)
+
+## Quick Start
+
+```bash
+# Dev shell
+nix develop
+
+# Run (prints CLI help)
+nix run . -- --help
+
+# Build package
+nix build .#
+```
+
+### First Build: Update `pnpmDepsHash`
+
+The Nix package uses `buildPnpmPackage`, which requires a fixed dependency hash.
+
+On the first `nix build`, Nix will fail with a message containing the expected
+hash (looks like `got: sha256-...`). Copy that value into `nix/package.nix` as
+`pnpmDepsHash`, then rebuild.
+
+## NixOS Module
+
+The flake exports `nixosModules.flynn`.
+
+Example:
+
+```nix
+{
+  inputs.flynn.url = "github:will666/flynn";
+
+  outputs = { self, nixpkgs, flynn, ... }: {
+    nixosConfigurations.myHost = nixpkgs.lib.nixosSystem {
+      system = "x86_64-linux";
+      modules = [
+        flynn.nixosModules.flynn
+        {
+          services.flynn = {
+            enable = true;
+            configFile = "/etc/flynn/config.yaml";
+            dataDir = "/var/lib/flynn";
+          };
+        }
+      ];
+    };
+  };
+}
+```
+

docs/deployment/PRODUCTION.md

@@ -6,6 +6,7 @@ This guide covers deploying Flynn in a production environment.
 
 - [Prerequisites](#prerequisites)
 - [Docker Deployment](#docker-deployment)
+- [Nix Deployment](#nix-deployment)
 - [Systemd Service](#systemd-service)
 - [Security](#security)
 - [Configuration](#configuration)
@@ -95,6 +96,11 @@ export ANTHROPIC_API_KEY=sk-...
 export OPENAI_API_KEY=sk-...
 ```
 
+## Nix Deployment
+
+If you use Nix, this repo ships a flake (package + dev shell + optional NixOS
+module). See `docs/deployment/NIX.md`.
+
 ## Systemd Service
 
 ### Service File