feat: add Python packaging metadata and a Nix flake

Package the proxy properly so it can be consumed outside a container, and
without downstream users vendoring a package definition into their own
configuration.

- pyproject.toml: setuptools metadata with a `legacy-email-proxy` console
  script. Runtime dependencies are read dynamically from requirements.txt, so
  the Docker build and the package cannot drift apart.
- proxy_server.run(): a synchronous entry point for the console script, since
  `main` is a coroutine and cannot be referenced by one directly. The
  `__main__` path is unchanged in behaviour.
- package.nix / flake.nix: the package, an overlay, and a dev shell. The test
  suite runs as part of the build, so `nix flake check` covers it.
- module.nix: a NixOS module exposing `services.legacy-email-proxy` with
  freeform `settings` (environment variables) and a separate `environmentFile`
  for credentials, so secrets stay out of the Nix store. Runs under
  DynamicUser with CAP_NET_BIND_SERVICE only while a listener needs a
  privileged port, and opens no firewall ports.

The Dockerfile and its CI workflow are deliberately untouched.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

flake.nix

@@ -0,0 +1,54 @@
+{
+  description = "Unauthenticated POP3/SMTP front end proxied to authenticated IMAPS/SMTPS backends";
+
+  inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+
+  outputs =
+    { self, nixpkgs }:
+    let
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
+      forAllSystems = fn: nixpkgs.lib.genAttrs systems (system: fn nixpkgs.legacyPackages.${system});
+    in
+    {
+      overlays.default = final: _prev: {
+        legacy-email-proxy = final.callPackage ./package.nix { };
+      };
+
+      packages = forAllSystems (pkgs: rec {
+        legacy-email-proxy = pkgs.callPackage ./package.nix { };
+        default = legacy-email-proxy;
+      });
+
+      # The NixOS module with its package option pointed at this flake's build,
+      # so consumers need no overlay. Use nixosModules.legacy-email-proxy
+      # instead if you would rather apply overlays.default yourself.
+      nixosModules.default =
+        { lib, pkgs, ... }:
+        {
+          imports = [ ./module.nix ];
+          services.legacy-email-proxy.package =
+            lib.mkDefault
+              self.packages.${pkgs.stdenv.hostPlatform.system}.legacy-email-proxy;
+        };
+      nixosModules.legacy-email-proxy = ./module.nix;
+
+      # The package builds only if the test suite passes, so this covers both.
+      checks = forAllSystems (pkgs: {
+        inherit (self.packages.${pkgs.system}) legacy-email-proxy;
+      });
+
+      devShells = forAllSystems (pkgs: {
+        default = pkgs.mkShellNoCC {
+          inputsFrom = [ self.packages.${pkgs.system}.legacy-email-proxy ];
+          packages = [ pkgs.python3Packages.pytest ];
+        };
+      });
+
+      formatter = forAllSystems (pkgs: pkgs.nixfmt-tree);
+    };
+}