add nix flake with devShell and native package build

devShell: nodejs_20, pnpm_8, prisma + prisma-engines, sqlite, openssl,
plus the env wiring so prisma uses nix-provided engines instead of
fetching from binaries.prisma.sh.

packages.default: full native build via pnpm_8.fetchDeps + configHook.
Patches the workspace:* ndk spec to the lockfile-resolved ^2.8.1 so
--frozen-lockfile accepts it, then re-runs install with scripts to
trigger bcrypt's node-pre-gyp fallback-to-build (uses python311 since
node-gyp 9.4.1 bundled with pnpm 8 still imports distutils).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

flake.nix

@@ -0,0 +1,51 @@
+{
+  description = "nsecbunkerd — Nostr remote signing daemon (NIP-46)";
+
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
+
+  outputs = { self, nixpkgs }:
+    let
+      systems = [ "x86_64-linux" "aarch64-linux" ];
+      forAllSystems = nixpkgs.lib.genAttrs systems;
+      pkgsFor = system: import nixpkgs { inherit system; };
+    in
+    {
+      packages = forAllSystems (system:
+        let pkgs = pkgsFor system; in
+        rec {
+          default = nsecbunkerd;
+          nsecbunkerd = pkgs.callPackage ./package.nix { };
+        }
+      );
+
+      devShells = forAllSystems (system:
+        let pkgs = pkgsFor system; in
+        {
+          default = pkgs.mkShell {
+            packages = with pkgs; [
+              nodejs_20
+              pnpm_8
+              prisma
+              prisma-engines
+              python3
+              gcc
+              pkg-config
+              openssl
+              sqlite
+            ];
+
+            shellHook = ''
+              # Point prisma at the nix-provided engines so it doesn't try to
+              # download them from binaries.prisma.sh on every install.
+              export PRISMA_QUERY_ENGINE_BINARY=${pkgs.prisma-engines}/bin/query-engine
+              export PRISMA_QUERY_ENGINE_LIBRARY=${pkgs.prisma-engines}/lib/libquery_engine.node
+              export PRISMA_SCHEMA_ENGINE_BINARY=${pkgs.prisma-engines}/bin/schema-engine
+              export PRISMA_FMT_BINARY=${pkgs.prisma-engines}/bin/prisma-fmt
+              export PRISMA_INTROSPECTION_ENGINE_BINARY=${pkgs.prisma-engines}/bin/introspection-engine
+              export PRISMA_CLIENT_ENGINE_TYPE=binary
+            '';
+          };
+        }
+      );
+    };
+}