feat(infra): full Nix migration — all 6 services + CI/CD

- flake.nix: 6 derivations (hub, scraper, tools-gateway, tools-workers, tools-frontend, llm-api)
- Fetch submodule source via builtins.fetchGit with pinned revs
- Fix cargo HOME/TMPDIR for Nix sandbox permission issues
- Fix llm-api: CMake/Clang deps for llama.cpp-sys2 bindgen
- Add LIBCLANG_PATH, LD_LIBRARY_PATH for Rust bindgen builds
- Systemd units: tools-gateway (3501), tools-frontend (3500), tools-workers, llm-api (8080)
- tools.target for grouped management
- Env configs: /etc/tools/env, /etc/llm-api/env
- GitHub Actions: nix-build.yml — matrix build + nix copy + deploy
- Update Traefik apps.yaml: tools/host.docker.internal:3500, llm-api/host.docker.internal:8080
- iptables: allow Docker→host on 3099, 4091, 3500, 3501, 8080
- Add scripts/nix-deploy.sh for CI/CD deploy step

infra/traefik/dynamic/apps.yaml

@@ -64,12 +64,12 @@ http:
     tools-service:
       loadBalancer:
         servers:
-          - url: 'http://tools:3000'
+          - url: 'http://host.docker.internal:3500'
 
     llm-api-service:
       loadBalancer:
         servers:
-          - url: 'http://llm-api:8080'
+          - url: 'http://host.docker.internal:8080'
 
     jaeger-service:
       loadBalancer: