chore(nix): add flake support for build, run, and devShell

[sshawn9]

Problem

There is no first-class way to build or run OmnySSH from a Nix-based system.
Users on NixOS, nix-darwin, or with Nix installed on other distros currently
have to either install Rust system-wide or fall back to cargo install omnyssh, neither of which fits a reproducible Nix workflow.

Solution

Add a flake.nix that exposes:

• packages.default (and packages.omnyssh) — builds the omny binary via
  rustPlatform.buildRustPackage, using Cargo.lock for hash pinning, and
  installs the generated doc/omny.1 man page via installManPage.
• apps.default — entry point for nix run, with meta populated from the
  package so nix flake check is warning-free.
• devShells.default — rustc, cargo, rustfmt, clippy, rust-analyzer,
  plus all build inputs from the package, with RUST_SRC_PATH set for LSP
  std-library navigation.

Implementation notes:

• pname / version / description / homepage are read from Cargo.toml
  via builtins.fromTOML, so they stay in sync without duplication.
• No Apple SDK frameworks are referenced — the legacy
  darwin.apple_sdk.frameworks.* paths were removed in recent nixpkgs and
  modern stdenv on Darwin already exposes what russh needs.
• nixpkgs is pinned to nixos-unstable; flake-utils is used only for
  eachDefaultSystem to avoid hand-rolling the system list.

README.md gets a new ❄️ Nix (Flakes) section under Installation, after
From Source, covering nix run, nix build, nix profile install, and
nix develop.

Test plan

• nix flake check --all-systems — passes for x86_64-linux,
  aarch64-linux, x86_64-darwin, aarch64-darwin with no warnings.
• nix build . on x86_64-linux — produces ./result/bin/omny.
• nix run . and nix run . -- --help — binary launches.
• nix develop — drops into a shell where cargo build and
  cargo clippy -- -D warnings succeed.
• cargo test && cargo clippy -- -D warnings && cargo fmt --check —
  unaffected; no Rust source changes.
• README.md renders correctly on GitHub.

Checklist

• All tests pass (cargo test)
• No clippy warnings (cargo clippy -- -D warnings)
• Code is formatted (cargo fmt)
• Relevant tests added — N/A, packaging-only change
• CHANGELOG entry added — happy to add one under "Unreleased" if you
  prefer; left out for now since this is build-tooling, not a user-visible
  runtime change
• README updated

Files changed

• flake.nix — new
• flake.lock — new (generated, pins nixpkgs and flake-utils)
• README.md — new "❄️ Nix (Flakes)" section under Installation