feat(self-host): Nix flake and NixOS module for Maple Local - #2410

🟢 Confidence 8/10 · likely safe to merge. Held at 8 because 1 reviewed file was not read.
_{1 note · tests covered · risk medium · 1 file not read · 1 fix not yet re-checked against the whole diff}

Adds a Nix flake and a services.maple NixOS module that run the released Maple Local bundle under systemd, with a NixOS VM test, a release-pin job and docs. Confined to new packaging files; nothing to fix before merge. flake.lock was not read (lockfile).

• flake.nix packages the released bundle and exports nixosModules.maple
• services.maple runs maple start under systemd with LoadCredential secrets
• The bin/maple wrapper refuses update and sets MAPLE_NO_UPDATE_CHECK=1
• A release job re-pins nix/release.json and dispatches the Nix check

Still open from earlier reviews

• 🔵 Note · F2 · overlays.default yields maple as an unfree package that throws on evaluate · flake.nix:42

Fixed since the last review

• ✅ F3 · Empty-secret refusal (exit 78) is not covered by the VM test

Production impact

_{5b5c911 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}