feat: flake wrapper exposing modules, hardware, lib, overlay

[abstracts33d]

Summary

Adds a thin `flake.nix` wrapper at the repo root so external Nix flake consumers can import Sécurix's modules, hardware profiles, lib, and pkgs overlay without depending on npins. The existing `default.nix` (npins-based) remains the primary build path; the flake re-uses it via `sources = inputs // (import ./npins)` so flake inputs override npins where present and npins remains the fallback for any source the flake doesn't provide (e.g. `git-hooks`).

Outputs exposed

• `nixosModules.securix-base = ./modules`
• `nixosModules.securix-hardware.` for each laptop SKU (x280, elitebook645g11, elitebook850g8, latitude5340, t14g6, x9-15, e14-g7)
• `nixosModules.securix-hardware-all = ./hardware`
• `overlays.default = import ./pkgs/overlay.nix`
• `lib.forSystem = system: (securixFor system).lib`
• per-system `packages.shell`, `devShells.default`, `legacyPackages.sx`

Why

Pilot integration with NixFleet — a NixOS fleet management framework — to evaluate running Sécurix endpoints under a unified `mkHost` API alongside server-class hosts in the same fleet. The flake wrapper is the minimum-friction entrypoint; nothing in the existing build paths changes.

Files

• `flake.nix` (new, 106 lines)
• `flake.lock` (new, generated)
• `flake.lock.license` (new, REUSE sidecar matching the `npins/sources.json.license` pattern)

No changes to `default.nix`, `lib/`, `modules/`, `hardware/`, `pkgs/`, or `npins/`.

How to test

• `nix-instantiate --parse flake.nix` → no errors
• `nix flake show --all-systems` → lists all 7 hardware SKUs by name + the other outputs above
• Existing build path unchanged: `nix-build -A tests` should produce the same closures it did before
• Pre-push hooks pass: `nixfmt-rfc-style`, `statix`, `reuse` (verified locally)

External consumer smoke (pilot context)

Tested by importing `securix-base` from a downstream flake and evaluating a minimal NixOS configuration to a derivation. Several upstream surface bugs were surfaced during this test — none caused by this PR, but worth noting for separate fixes:

1. `securix.self.user.username` derivation via `deriveUsernameFromEmail` embeds `@` in the result for emails with dotted domains (`name@gouv.fr` → splits on `.`, concatenates first-letter + `name@gouv`).
2. `securix.graphical-interface.variant` enum is checked even when `enable = false`.
3. `modules/bootloader.nix` uses `lib.mkForce` for both `systemd-boot.enable` and `lanzaboote.enable`; consumers in non-Secure-Boot environments need `lib.mkOverride 0` to override. `lib.mkDefault` would be friendlier.
4. `hardware/elitebook850g8.nix` exists but the SKU is missing from the `securix.self.machine.hardwareSKU` enum in `modules/self.nix`.

Happy to open separate PRs for any of these if useful.

Status

Alpha — matches the project's overall alpha posture. This wrapper is purely additive and should not affect existing users.