Package the panel as a Nix flake with a NixOS module

The panel now lives in its own repository instead of the nixos config.
The flake provides:

- packages.<system>.default: panelctl plus a panel-api wrapper, with the
  frontend under share/panel and runtime tools appended to PATH
- nixosModules.default: services.reudy-panel (service, directories,
  shared routes group, Caddy vhost with optional Authelia forward_auth,
  routes import and reload path unit, Forgejo integration)
- overlays.default, and checks that build the package and evaluate a
  host using the module

panelctl takes the routes file owner from PANEL_USER/PANEL_GROUP
instead of hardcoding reudy:panelroutes (defaults unchanged).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UbWSNkXxZhYf7eqHTyx3Bf

nix/package.nix

@@ -0,0 +1,85 @@
+{
+  lib,
+  stdenvNoCC,
+  makeWrapper,
+  bash,
+  python3,
+  podman,
+  podman-compose,
+  curl,
+  coreutils,
+  gnugrep,
+  gnused,
+  gawk,
+  findutils,
+  zip,
+  unzip,
+  git,
+  util-linux,
+  openssh,
+}:
+
+let
+  # Tools panelctl shells out to. They are appended to PATH, so the host's own
+  # versions (e.g. the system podman) still take precedence when present.
+  runtimeDeps = [
+    podman
+    podman-compose
+    curl
+    coreutils
+    gnugrep
+    gnused
+    gawk
+    findutils
+    zip
+    unzip
+    git
+    util-linux # flock, used to serialise routes file writes
+    openssh # cloning repositories over ssh with the panel's deploy key
+  ];
+in
+stdenvNoCC.mkDerivation {
+  pname = "reudy-panel";
+  version = "0.1.0";
+
+  src = lib.fileset.toSource {
+    root = ../.;
+    fileset = lib.fileset.unions [
+      ../panel-api.py
+      ../panelctl.sh
+      ../frontend
+    ];
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ bash ];
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 panel-api.py $out/share/panel/panel-api.py
+    cp -r frontend $out/share/panel/frontend
+
+    install -Dm755 panelctl.sh $out/bin/panelctl
+    patchShebangs --host $out/bin/panelctl
+    wrapProgram $out/bin/panelctl \
+      --suffix PATH : ${lib.makeBinPath runtimeDeps}
+
+    makeWrapper ${python3.interpreter} $out/bin/panel-api \
+      --add-flags $out/share/panel/panel-api.py \
+      --suffix PATH : ${lib.makeBinPath runtimeDeps} \
+      --set-default PANELCTL_PATH $out/bin/panelctl \
+      --set-default PANEL_FRONTEND_DIR $out/share/panel/frontend
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Small web panel for deploying Podman compose apps behind Caddy";
+    mainProgram = "panel-api";
+    platforms = lib.platforms.linux;
+  };
+}