feat(docker): add dev.sh with auto-funding and ATM app setup

- Add dev.sh script for managing regtest development environment
- Implement cmd_fund to fund ATM app owner via Lightning.Pub API
- Add --fund flag to cmd_up for automatic funding on startup
- Update setup_atm_app to write VITE_APP_ID to machine .env
- Fix Electron IPC to pass appId and extensionApiUrl to renderer
- Restructure repo from nested lamassu-next/ to root

The dev.sh script now supports:
- ./dev.sh up --fund  # Start regtest and auto-fund ATM
- ./dev.sh fund       # Fund existing ATM app
- ./dev.sh status     # Show environment status
- ./dev.sh reset      # Clean restart

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

flake.nix

@@ -0,0 +1,86 @@
+{
+  description = "Lamassu Next - Nostr-Native Lightning ATM";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    devenv = {
+      url = "github:cachix/devenv";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs = { self, nixpkgs, flake-utils, rust-overlay, devenv }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        overlays = [ (import rust-overlay) ];
+        pkgs = import nixpkgs { inherit system overlays; };
+
+        rustToolchain = pkgs.rust-bin.stable.latest.default.override {
+          extensions = [ "rust-src" "rust-analyzer" ];
+          targets = [ "wasm32-unknown-unknown" ];
+        };
+      in
+      {
+        # Development shell via devenv
+        devShells.default = devenv.lib.mkShell {
+          inherit pkgs;
+          modules = [ ./devenv.nix ];
+        };
+
+        # Packages
+        packages = {
+          # HAL Rust crate
+          hal = pkgs.rustPlatform.buildRustPackage {
+            pname = "lamassu-hal";
+            version = "0.1.0";
+            src = ./packages/hal;
+            cargoLock.lockFile = ./packages/hal/Cargo.lock;
+
+            nativeBuildInputs = with pkgs; [
+              pkg-config
+            ];
+
+            buildInputs = with pkgs; [
+              openssl
+              libudev-zero
+            ];
+          };
+
+          # Full application (TODO)
+          default = self.packages.${system}.hal;
+        };
+
+        # NixOS module for deployment
+        nixosModules.default = { config, lib, pkgs, ... }: {
+          options.services.lamassu-atm = {
+            enable = lib.mkEnableOption "Lamassu ATM service";
+
+            relayUrl = lib.mkOption {
+              type = lib.types.str;
+              description = "Nostr relay URL";
+            };
+
+            lightningPubUrl = lib.mkOption {
+              type = lib.types.str;
+              description = "Lightning.Pub connection URL";
+            };
+
+            identityPath = lib.mkOption {
+              type = lib.types.path;
+              default = "/etc/lamassu/machine.nsec";
+              description = "Path to machine identity (nsec)";
+            };
+          };
+
+          config = lib.mkIf config.services.lamassu-atm.enable {
+            # TODO: systemd service, firewall rules, etc.
+          };
+        };
+      }
+    );
+}