Adds the canonical Nix CI/CD deploy workflow (install Nix, build .#default, copy to VPS via SSH, update profile, systemctl restart) previously missing from this repo. Enforces push-to-GitHub + GHA deploy only (no direct deploy).