feat: include atm-tui in NixOS ATM deployments

Add atm-tui as a flake input and include it in environment.systemPackages
for both live and installed NixOS configs. The TUI will be available as
'atm-tui' on PATH after deployment — no more manual SCP.

The binary is pushed to cachix alongside the ATM app, so douro pulls
it from the binary cache on upgrade (no local compilation needed).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

flake.lock

@@ -1,5 +1,25 @@
 {
   "nodes": {
+    "atm-tui": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ]
+      },
+      "locked": {
+        "lastModified": 1774249805,
+        "narHash": "sha256-NLRIrb6fLYx9qkIMX+5yOLQdLTkXKAeeEaKrk96sYvw=",
+        "ref": "refs/heads/main",
+        "rev": "e28ba583d95597ad0b79c307dca8b19cb1d601c3",
+        "revCount": 20,
+        "type": "git",
+        "url": "ssh://forgejo@git.atitlan.io/aiolabs/atm-tui.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://forgejo@git.atitlan.io/aiolabs/atm-tui.git"
+      }
+    },
     "cachix": {
       "inputs": {
         "devenv": [
@@ -479,6 +499,7 @@
     },
     "root": {
       "inputs": {
+        "atm-tui": "atm-tui",
         "determinate": "determinate",
         "devenv": "devenv",
         "flake-utils": "flake-utils",

flake.nix

@@ -23,9 +23,15 @@
     # Determinate Nix — ensures douro uses same nix version as dev machines
     # so cachix binary cache hits match (nix 2.33 hashes == nix 2.33 hashes)
     determinate.url = "https://flakehub.com/f/DeterminateSystems/determinate/3";
+
+    # ATM TUI — operator management tool
+    atm-tui = {
+      url = "git+ssh://forgejo@git.atitlan.io/aiolabs/atm-tui.git";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+    };
   };
 
-  outputs = { self, nixpkgs, nixpkgs-unstable, flake-utils, rust-overlay, devenv, determinate }:
+  outputs = { self, nixpkgs, nixpkgs-unstable, flake-utils, rust-overlay, devenv, determinate, atm-tui }:
     let
       system = "x86_64-linux";
 
@@ -71,6 +77,7 @@
           modules = [
             ./deploy/nixos/live.nix
             determinate.nixosModules.default
+            { environment.systemPackages = [ atm-tui.packages.${system}.default ]; }
           ];
         };
 
@@ -101,6 +108,9 @@
                 appDir = "${atm-app}";
               };
 
+              # Operator TUI for local machine management
+              environment.systemPackages = [ atm-tui.packages.${system}.default ];
+
               # Electron sandbox needs unprivileged user namespaces
               boot.kernel.sysctl."kernel.unprivileged_userns_clone" = 1;