feat: add Python packaging metadata and a Nix flake (#16)

## What

- `pyproject.toml` — setuptools metadata with a `legacy-email-proxy` console script. Runtime dependencies are read dynamically from `requirements.txt`, so the Docker build and the package cannot drift apart.
- `proxy_server.run()` — a synchronous entry point for that console script; `main` is a coroutine and cannot be referenced by one. The `__main__` path behaves as before.
- `flake.nix` / `package.nix` — the package, `overlays.default`, a dev shell, and `checks`. The pytest suite runs as part of the build.
- `module.nix` — a NixOS module: `services.legacy-email-proxy` with freeform `settings` (environment variables) and a separate `environmentFile` for credentials, so secrets stay out of the Nix store. Runs under `DynamicUser`, takes `CAP_NET_BIND_SERVICE` only while a listener is on a privileged port, and opens no firewall ports.
- README: pip install, Nix usage, and a NixOS service example.

## Why

The proxy could only be consumed as a container. Anyone deploying it on NixOS had to vendor a package definition into their own configuration — which is exactly what happened downstream, and is now deleted there in favour of this.

## Not in scope

- The `Dockerfile` and its CI workflow are untouched.
- No Nix job in CI; the runner has no Nix. The build is reproducible locally with `nix flake check`.
- `version` is static and tracks the latest tag (`0.3.0`); bump it with the tag.

## Verification

- `nix flake check` — package builds, 14 tests pass inside the build.
- Consumed from a downstream NixOS host with `--override-input`: the unit's `ExecStart` resolves to the module's own build, and that flake's checks pass too.

---------

Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com>
Reviewed-on: #16

package.nix

@@ -0,0 +1,40 @@
+{
+  lib,
+  python3Packages,
+}:
+python3Packages.buildPythonApplication {
+  pname = "legacy-email-proxy";
+  inherit ((lib.importTOML ./pyproject.toml).project) version;
+  pyproject = true;
+
+  # Only the files that affect the build, so editing the README or the CI
+  # workflow does not invalidate it.
+  src = lib.fileset.toSource {
+    root = ./.;
+    fileset = lib.fileset.unions [
+      ./proxy_server.py
+      ./pyproject.toml
+      ./requirements.txt
+      ./pytest.ini
+      ./tests
+    ];
+  };
+
+  build-system = [ python3Packages.setuptools ];
+  dependencies = [ python3Packages.aiosmtpd ];
+
+  nativeCheckInputs = [ python3Packages.pytestCheckHook ];
+
+  meta = {
+    description = "Unauthenticated POP3/SMTP front end proxied to authenticated IMAPS/SMTPS backends";
+    longDescription = ''
+      Exposes cleartext POP3 and SMTP to clients that cannot speak TLS or
+      modern authentication, and forwards them to an authenticated IMAPS/SMTPS
+      backend. The front-end listeners are unauthenticated by design and must
+      be confined to a trusted network.
+    '';
+    homepage = "https://code.emmathe.dev/lyrathorpe/legacy-email-proxy";
+    mainProgram = "legacy-email-proxy";
+    platforms = lib.platforms.unix;
+  };
+}