Package the panel as a Nix flake with a NixOS module

The panel now lives in its own repository instead of the nixos config.
The flake provides:

- packages.<system>.default: panelctl plus a panel-api wrapper, with the
  frontend under share/panel and runtime tools appended to PATH
- nixosModules.default: services.reudy-panel (service, directories,
  shared routes group, Caddy vhost with optional Authelia forward_auth,
  routes import and reload path unit, Forgejo integration)
- overlays.default, and checks that build the package and evaluate a
  host using the module

panelctl takes the routes file owner from PANEL_USER/PANEL_GROUP
instead of hardcoding reudy:panelroutes (defaults unchanged).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UbWSNkXxZhYf7eqHTyx3Bf

panelctl.sh

@@ -9,6 +9,9 @@ STATE_DIR="${BASE_DIR}/state"
 APPS_DIR="${STATE_DIR}/apps"
 ENV_DIR="${STATE_DIR}/env"
 BACKUPS_DIR="${BASE_DIR}/backups"
+# Owner of generated files that Caddy has to read (via the shared group).
+PANEL_USER="${PANEL_USER:-reudy}"
+PANEL_GROUP="${PANEL_GROUP:-panelroutes}"
 
 # Set by load_app: compose file arguments, and the app's environment variables
 # as KEY=VALUE words (passed to compose via env(1), never sourced).
@@ -466,7 +469,7 @@ cmd_render_route() {
     printf "# route:%s:end\n" "${name}"
   } >>"${tmp}"
 
-  install -m 0664 -o reudy -g panelroutes "${tmp}" "${route_file}"
+  install -m 0664 -o "${PANEL_USER}" -g "${PANEL_GROUP}" "${tmp}" "${route_file}"
   rm -f "${tmp}"
   routes_unlock
   log info "rendered route ${route_file}"
@@ -585,7 +588,7 @@ cmd_remove() {
     local tmp
     tmp="$(mktemp)"
     sed "/^# route:${name}:start$/,/^# route:${name}:end$/d" "${route_file}" >"${tmp}" || true
-    install -m 0664 -o reudy -g panelroutes "${tmp}" "${route_file}"
+    install -m 0664 -o "${PANEL_USER}" -g "${PANEL_GROUP}" "${tmp}" "${route_file}"
     rm -f "${tmp}"
     routes_unlock
   fi