Package the panel as a Nix flake with a NixOS module

The panel now lives in its own repository instead of the nixos config.
The flake provides:

- packages.<system>.default: panelctl plus a panel-api wrapper, with the
  frontend under share/panel and runtime tools appended to PATH
- nixosModules.default: services.reudy-panel (service, directories,
  shared routes group, Caddy vhost with optional Authelia forward_auth,
  routes import and reload path unit, Forgejo integration)
- overlays.default, and checks that build the package and evaluate a
  host using the module

panelctl takes the routes file owner from PANEL_USER/PANEL_GROUP
instead of hardcoding reudy:panelroutes (defaults unchanged).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UbWSNkXxZhYf7eqHTyx3Bf

README.md

@@ -2,6 +2,51 @@
 
 Minimal container management panel for rootless Podman + Caddy.
 
+## Installing on NixOS
+
+This repository is a flake that provides the panel as a package
+(`packages.<system>.default`) and a NixOS module (`nixosModules.default`).
+Add it to your system flake:
+
+```nix
+{
+  inputs.panel = {
+    url = "git+https://git.reudy.net/reudy-net/panel";
+    inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  outputs = { nixpkgs, panel, ... }: {
+    nixosConfigurations.vps = nixpkgs.lib.nixosSystem {
+      modules = [
+        panel.nixosModules.default
+        {
+          services.reudy-panel = {
+            enable = true;
+            domain = "panel.example.com";     # Caddy virtual host
+            autheliaAddress = "127.0.0.1:9091"; # forward_auth in front of it
+          };
+        }
+      ];
+    };
+  };
+}
+```
+
+The module sets up the `panel-api` service, the directories below, the
+`panelroutes` group shared with Caddy, the Caddy import of the generated routes
+and a path unit that reloads Caddy when they change. With Forgejo enabled on
+the same host, its URLs are passed to the panel automatically
+(`services.reudy-panel.forgejo.enable`). See `nix/module.nix` for all options.
+
+To deploy a new panel version, bump the input and rebuild:
+
+```bash
+nix flake update panel
+sudo nixos-rebuild switch --flake .#vps
+```
+
+Checks (package build and a module evaluation) run with `nix flake check`.
+
 ## Base directory
 
 `/var/lib/containers`