feat(deploy): add NixOS live USB ISO for ATM hardware testing

Add NixOS configuration to build a bootable live USB ISO that runs the
ATM Electron app in kiosk mode on physical hardware (UpBoard). The ISO
boots from squashfs, auto-starts X11/openbox, and launches Electron in
production mode.

Key changes:
- deploy/nixos/live.nix: Live USB module (squashfs+tmpfs, no disk install)
- deploy/nixos/flake.nix: Nix flake with ISO build output
- deploy/nixos/provision-atm.sh: Auto-provision LP credentials via API
- deploy/nixos/build-iso.sh: End-to-end build workflow script
- apps/machine: Fix Electron production mode (ELECTRON_FORCE_PROD),
  Vue Router hash mode for file:// protocol, relative asset paths

Build: cd deploy/nixos && bash build-iso.sh
Test:  qemu-system-x86_64 -enable-kvm -m 2G -cdrom result/iso/*.iso

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

deploy/nixos/udev/99-lamassu-hardware.rules

@@ -0,0 +1,57 @@
+# Lamassu ATM Hardware udev Rules
+# Place in /etc/udev/rules.d/ or use services.udev.extraRules in NixOS
+
+# ============================================
+# Bill Validators
+# ============================================
+
+# ID-003 Bill Validator (JCM/Japan Cash Machine)
+# Uses TI USB-Serial chip
+SUBSYSTEM=="tty", ATTRS{idVendor}=="0451", ATTRS{idProduct}=="3410", MODE="0666", GROUP="dialout", SYMLINK+="bill-validator"
+
+# MEI Bill Validator (Mars Electronics)
+SUBSYSTEM=="tty", ATTRS{idVendor}=="0b00", MODE="0666", GROUP="dialout", SYMLINK+="bill-validator"
+
+# CCNET Bill Validator (CashCode)
+SUBSYSTEM=="tty", ATTRS{idVendor}=="1b5a", MODE="0666", GROUP="dialout", SYMLINK+="bill-validator"
+
+# ============================================
+# Bill Dispensers
+# ============================================
+
+# Puloon Bill Dispenser (uses FTDI chip)
+SUBSYSTEM=="tty", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6001", MODE="0666", GROUP="dialout", SYMLINK+="bill-dispenser"
+
+# Genmega Bill Dispenser
+SUBSYSTEM=="tty", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6015", MODE="0666", GROUP="dialout", SYMLINK+="bill-dispenser"
+
+# ============================================
+# Generic USB-Serial Adapters
+# ============================================
+
+# Prolific PL2303
+SUBSYSTEM=="tty", ATTRS{idVendor}=="067b", MODE="0666", GROUP="dialout"
+
+# FTDI
+SUBSYSTEM=="tty", ATTRS{idVendor}=="0403", MODE="0666", GROUP="dialout"
+
+# Silicon Labs CP210x
+SUBSYSTEM=="tty", ATTRS{idVendor}=="10c4", MODE="0666", GROUP="dialout"
+
+# CH340/CH341
+SUBSYSTEM=="tty", ATTRS{idVendor}=="1a86", MODE="0666", GROUP="dialout"
+
+# ============================================
+# Camera
+# ============================================
+
+# Allow access to all video4linux devices (cameras)
+SUBSYSTEM=="video4linux", MODE="0666", GROUP="video"
+
+# ============================================
+# Printers
+# ============================================
+
+# Common thermal receipt printers
+SUBSYSTEM=="usb", ATTRS{idVendor}=="04b8", MODE="0666", GROUP="lp"  # Epson
+SUBSYSTEM=="usb", ATTRS{idVendor}=="0519", MODE="0666", GROUP="lp"  # Star Micronics