feat(infra): Nix build for scraper, GitHub Actions workflow

- Build scraper (Rust) with Nix — cargo build --release
- Create scraper systemd unit (port 4091), env from Docker config
- Fix HOME/CARGO_HOME for Rust/cargo in Nix sandbox
- Update Traefik apps.yaml: scraper -> host.docker.internal:4091
- Add iptables rules for port 4091 (Docker->host)
- Add GitHub Actions workflow: nix-build.yml (determinate-nix + deploy)
- Save iptables rules persistently

flake.nix

@@ -31,6 +31,9 @@
             NODE_EXTRA_CA_CERTS = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
             NODE_ENV = "production";
 
+            HOME = "/tmp";
+            CARGO_HOME = "/tmp/.cargo";
+
             phases = [ "unpackPhase" "buildPhase" "installPhase" ];
             buildPhase = buildScript;
             installPhase = installScript;