feat(nix): add flake.nix exposing lib.mkWebapp

Establishes the nix build path so deploy/server-deploy can call
inputs.webapp.lib.mkWebapp { brandDir, app } per-host instead of
running its own derivation.

lib.mkWebapp { pkgs, brandDir ? ./branding/default, app ? "main" }
returns a stdenv.mkDerivation that:
- Uses pnpmConfigHook + fetchPnpmDeps (fetcherVersion = 3) to install
  node_modules from a hash-pinned snapshot, offline.
- Wires brandDir into the BRAND_DIR env var so vite-branding.ts and
  pwa-assets.config.ts resolve the right brand.
- Sets BRAND_APP from `app` so per-standalone overrides
  (branding/<dep>/icons/<app>/logo.*) work.
- autoPatchelfHook + stdenv.cc.cc.lib patch the prebuilt
  @img/sharp-libvips-linux-x64 binaries to run under the nix sandbox.
- Runs `pnpm run build` for the hub or `pnpm run build:<app>` for a
  standalone, then copies the resulting dist/ or dist-<app>/ into $out.

Per-system exposure:
- packages.<app> for each of main/events/wallet/chat/market/forum/
  tasks/restaurant/libra — exercises the builder under CI.
- packages.default = packages.main.

Closes aiolabs/webapp#97. Server-deploy hosts can now migrate via
aiolabs/server-deploy#8.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

flake.lock

@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1780749050,
+        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,90 @@
+{
+  description = "AIO webapp — modular Vue 3 + Vite shell with Lightning + Nostr standalones";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { self, nixpkgs, flake-utils }:
+    let
+      apps = [ "main" "events" "wallet" "chat" "market" "forum" "tasks" "restaurant" "libra" ];
+
+      mkWebapp = { pkgs, brandDir ? ./branding/default, app ? "main" }:
+        let
+          buildScript = if app == "main" then "build" else "build:${app}";
+          outDir = if app == "main" then "dist" else "dist-${app}";
+        in
+        pkgs.stdenv.mkDerivation (finalAttrs: {
+          pname = "aio-webapp-${app}";
+          version = "0.0.0";
+
+          src = ./.;
+
+          pnpmDeps = pkgs.fetchPnpmDeps {
+            inherit (finalAttrs) pname version src;
+            fetcherVersion = 3;
+            hash = "sha256-GZuH5ndka9PEHjC00g+kUJW515Zj/+xW6DZQAaK8G4k=";
+          };
+
+          nativeBuildInputs = [
+            pkgs.nodejs
+            pkgs.pnpm
+            pkgs.pnpmConfigHook
+            pkgs.autoPatchelfHook
+          ];
+
+          # sharp's prebuilt libvips binaries (under @img/sharp-libvips-*)
+          # are dynamically linked; autoPatchelfHook needs the runtime libs.
+          buildInputs = [
+            pkgs.stdenv.cc.cc.lib
+          ];
+
+          # Brand kit env knobs read by vite-branding.ts and
+          # pwa-assets.config.ts. brandDir is either ./branding/default
+          # (a path inside this flake's source) or an external path that
+          # nix has copied into the build sandbox.
+          env = {
+            BRAND_DIR = "${brandDir}";
+            BRAND_APP = if app == "main" then "" else app;
+          };
+
+          buildPhase = ''
+            runHook preBuild
+            pnpm run ${buildScript}
+            runHook postBuild
+          '';
+
+          installPhase = ''
+            runHook preInstall
+            mkdir -p $out
+            cp -r ${outDir} $out/
+            runHook postInstall
+          '';
+
+          meta = with pkgs.lib; {
+            description = "AIO webapp${if app == "main" then "" else " (${app} standalone)"}";
+            homepage = "https://git.atitlan.io/aiolabs/webapp";
+            license = licenses.mit;
+            platforms = platforms.linux;
+          };
+        });
+    in
+    {
+      # System-agnostic builder. Downstream NixOS hosts call this from
+      # their services/webapp.nix with their own brandDir.
+      lib.mkWebapp = mkWebapp;
+    }
+    // flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = import nixpkgs { inherit system; };
+        # One package per standalone, all using the aiolabs default brand.
+        # `nix build .#<app>` exercises the builder for sanity / CI.
+        appPackages = pkgs.lib.genAttrs apps (app: mkWebapp { inherit pkgs app; });
+      in
+      {
+        packages = appPackages // {
+          default = appPackages.main;
+        };
+      });
+}