feat: CI + Nix deploy + prod sectors-hackaton.asepharyana.my.id

- Backend serve web dist (WEB_DIST_DIR + SPA fallback, /api 404 JSON)
- flake.nix: single flowsight derivation (go 1.25 + pnpm build)
- deploy/flowsight.service: systemd on :4022 via bws-exec
- .github/workflows/ci.yml: go test + tsc gate, nix build, attic, SSH deploy

backend/internal/api/server.go

@@ -90,6 +90,9 @@ func (s *Server) Router() http.Handler {
 		r.Get("/accuracy", s.Accuracy)
 		r.Post("/chat", s.Chat)
 	})
+	if s.Cfg.StaticDir != "" {
+		r.NotFound(s.spaHandler())
+	}
 	return r
 }