Package the panel as a Nix flake with a NixOS module

The panel now lives in its own repository instead of the nixos config.
The flake provides:

- packages.<system>.default: panelctl plus a panel-api wrapper, with the
  frontend under share/panel and runtime tools appended to PATH
- nixosModules.default: services.reudy-panel (service, directories,
  shared routes group, Caddy vhost with optional Authelia forward_auth,
  routes import and reload path unit, Forgejo integration)
- overlays.default, and checks that build the package and evaluate a
  host using the module

panelctl takes the routes file owner from PANEL_USER/PANEL_GROUP
instead of hardcoding reudy:panelroutes (defaults unchanged).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UbWSNkXxZhYf7eqHTyx3Bf

flake.nix

@@ -0,0 +1,58 @@
+{
+  description = "Small web panel for deploying Podman compose apps behind Caddy";
+
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+
+  outputs =
+    { self, nixpkgs }:
+    let
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+      ];
+      forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
+    in
+    {
+      packages = forAllSystems (pkgs: rec {
+        reudy-panel = pkgs.callPackage ./nix/package.nix { };
+        default = reudy-panel;
+      });
+
+      overlays.default = final: _prev: {
+        reudy-panel = final.callPackage ./nix/package.nix { };
+      };
+
+      nixosModules = rec {
+        reudy-panel = ./nix/module.nix;
+        default = reudy-panel;
+      };
+
+      checks = forAllSystems (pkgs: {
+        package = self.packages.${pkgs.stdenv.hostPlatform.system}.default;
+
+        # Evaluates a small host using the module, so option or wiring mistakes
+        # fail here rather than on the server.
+        module =
+          (nixpkgs.lib.nixosSystem {
+            system = pkgs.stdenv.hostPlatform.system;
+            modules = [
+              self.nixosModules.default
+              {
+                boot.isContainer = true;
+                system.stateVersion = "25.11";
+                users.users.reudy.isNormalUser = true;
+                services.caddy.enable = true;
+                services.forgejo.enable = true;
+                services.reudy-panel = {
+                  enable = true;
+                  domain = "panel.example.com";
+                  autheliaAddress = "127.0.0.1:9091";
+                };
+              }
+            ];
+          }).config.system.build.toplevel;
+      });
+
+      formatter = forAllSystems (pkgs: pkgs.nixfmt-rfc-style);
+    };
+}