nix: expose overlay and NixOS module for infrastructure deployment

- Fix default.nix to build from workspace (imphnen-backend/Cargo.toml)
- Add overlays.default adding pkgs.imphnen-backend
- Add nixosModules.backend via nixos-module.nix
- NixOS module defines systemd service on port 8081 with environmentFile

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

nixos-module.nix

@@ -0,0 +1,48 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.imphnen-backend;
+in
+{
+  options.services.imphnen-backend = {
+    enable = lib.mkEnableOption "IMPHNEN backend service";
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 8081;
+      description = "Port the backend HTTP server listens on.";
+    };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Path to environment file with secrets (DATABASE_URL, JWT keys, etc).";
+    };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.imphnen-backend = {
+      description = "IMPHNEN Backend Service";
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "network.target"
+        "postgresql.service"
+      ];
+      serviceConfig = {
+        ExecStart = "${pkgs.imphnen-backend}/bin/api";
+        EnvironmentFile = cfg.environmentFile;
+        Environment = [ "PORT=${toString cfg.port}" ];
+        DynamicUser = true;
+        Restart = "on-failure";
+        RestartSec = "5s";
+        StandardOutput = "journal";
+        StandardError = "journal";
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
+  };
+}