feat(infra): Nix build for hub app, systemd deployment

- Add flake.nix with derivations for hub (Next.js), scraper, tools, llm-api
- Create hub systemd unit (port 3099)
- Update Traefik dynamic config to point to host hub service
- Add iptables rule for Docker-to-host communication
- Use fetchGit for submodule source resolution

infra/traefik/dynamic/apps.yaml

@@ -54,7 +54,7 @@ http:
     hub-service:
       loadBalancer:
         servers:
-          - url: 'http://hub:3000'
+          - url: 'http://host.docker.internal:3099'
 
     scraper-service:
       loadBalancer: