Add Nix package, NixOS module, and tests for bambuddy

- packages.bambuddy: FastAPI backend + prebuilt React frontend assembled
  into the app-root layout upstream expects, behind a single `bambuddy`
  launcher (uvicorn --loop asyncio, ffmpeg on PATH, XDG state defaults).
  Pins upstream maziggy/bambuddy v1.2.5.7.
- nixosModules.default: services.bambuddy with host/port/dataDir,
  openFirewall, environment + environmentFile, extraPackages,
  DynamicUser + StateDirectory, systemd hardening, and
  CAP_NET_BIND_SERVICE for the virtual-printer FTPS/RTSP ports.
- checks.bambuddy-import: backend import + admin CLI smoke test.
- checks.bambuddy-service: two-node NixOS VM test covering the health
  endpoint, UI/static assets/manifest, SQLite + logs in the
  StateDirectory, journal startup check, cross-node reachability with
  openFirewall, custom host/port/env node, and loopback-only binding.
- overlay, run app, devShell, README, .gitignore.

tests/import-check.nix

@@ -0,0 +1,27 @@
+{
+  lib,
+  runCommand,
+  bambuddy,
+}:
+# Fast package-level smoke test: import the full backend (which pulls in
+# every router, service and optional dependency) inside a sandbox with a
+# writable state dir, and exercise the admin CLI entrypoint. Catches broken
+# Python dependency closures long before the (much slower) VM test runs.
+runCommand "bambuddy-import-check"
+  {
+    nativeBuildInputs = [ bambuddy.passthru.pythonEnv ];
+    meta = {
+      description = "Bambuddy: verify the backend imports with the packaged dependency closure";
+    };
+  }
+  ''
+    export DATA_DIR="$PWD/state" LOG_DIR="$PWD/state/logs" HOME="$PWD/state" MPLCONFIGDIR="$PWD/state/mpl"
+    mkdir -p "$DATA_DIR" "$LOG_DIR"
+    export PYTHONPATH="${bambuddy}/share/bambuddy"
+
+    python -c 'import backend.app.main; print("backend.app.main imports cleanly")'
+
+    python -m backend.app.cli --help > /dev/null
+
+    touch $out
+  ''