refactor(nix): consolidate deploy flake into root flake with pure ISO builds

Move deploy/nixos/flake.nix into the root flake.nix, adding mkAtmApp
for pure Nix builds of the Electron app (no local pnpm needed). Simplify
build-iso.sh to a thin wrapper around `nix build .#iso-<model>`. Add
douro hardware configuration. Streamline live.nix to consume the
Nix-built app package.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

deploy/nixos/hardware/douro.nix

@@ -0,0 +1,89 @@
+# Douro (Bay Trail) Hardware Configuration
+# Bay Trail Atom SoC with eDP panel, mSATA internal storage.
+#
+# Kernel 5.15 LTS required: i915 eDP display regression in 6.x kernels
+# causes blank screen on Bay Trail with embedded DisplayPort panels.
+
+{ config, lib, pkgs, ... }:
+
+{
+  boot = {
+    loader = {
+      systemd-boot.enable = true;
+      efi.canTouchEfiVariables = true;
+      timeout = 3;
+    };
+
+    # Bay Trail needs 5.15 LTS (i915 eDP regression in 6.x)
+    kernelPackages = pkgs.linuxPackages_5_15;
+
+    initrd.availableKernelModules = [
+      "xhci_pci"
+      "ahci"
+      "usb_storage"
+      "sd_mod"
+      "sdhci_pci"
+      "i915"
+    ];
+
+    kernelModules = [
+      "kvm-intel"
+      "i2c-dev"
+      "spi-dev"
+    ];
+
+    kernelParams = [
+      "i915.enable_psr=0"
+      "vt.handoff=7" # Bay Trail: preserve BIOS display init
+      "quiet"
+      "splash"
+    ];
+  };
+
+  # Disk layout: GPT with ESP (sda1) + ext4 root (sda2)
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "ext4";
+  };
+
+  # make-disk-image.nix labels the ESP as "ESP" (not "boot")
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/ESP";
+    fsType = "vfat";
+  };
+
+  # NixOS 24.05 uses hardware.opengl (not hardware.graphics)
+  hardware = {
+    opengl = {
+      enable = true;
+      extraPackages = with pkgs; [
+        intel-media-driver
+        vaapiIntel
+        vaapiVdpau
+        libvdpau-va-gl
+      ];
+    };
+    enableRedistributableFirmware = true;
+    cpu.intel.updateMicrocode = true;
+  };
+
+  powerManagement = {
+    enable = true;
+    cpuFreqGovernor = "performance";
+  };
+
+  # Disable suspend/hibernate for kiosk
+  systemd.targets = {
+    sleep.enable = false;
+    suspend.enable = false;
+    hibernate.enable = false;
+    hybrid-sleep.enable = false;
+  };
+
+  # Serial port access for bill validator/dispenser
+  services.udev.extraRules = lib.mkAfter ''
+    KERNEL=="ttyS[0-9]*", MODE="0666"
+    KERNEL=="ttyUSB[0-9]*", MODE="0666"
+    KERNEL=="ttyACM[0-9]*", MODE="0666"
+  '';
+}