feat: add Python packaging metadata and a Nix flake

Package the proxy properly so it can be consumed outside a container, and
without downstream users vendoring a package definition into their own
configuration.

- pyproject.toml: setuptools metadata with a `legacy-email-proxy` console
  script. Runtime dependencies are read dynamically from requirements.txt, so
  the Docker build and the package cannot drift apart.
- proxy_server.run(): a synchronous entry point for the console script, since
  `main` is a coroutine and cannot be referenced by one directly. The
  `__main__` path is unchanged in behaviour.
- package.nix / flake.nix: the package, an overlay, and a dev shell. The test
  suite runs as part of the build, so `nix flake check` covers it.
- module.nix: a NixOS module exposing `services.legacy-email-proxy` with
  freeform `settings` (environment variables) and a separate `environmentFile`
  for credentials, so secrets stay out of the Nix store. Runs under
  DynamicUser with CAP_NET_BIND_SERVICE only while a listener needs a
  privileged port, and opens no firewall ports.

The Dockerfile and its CI workflow are deliberately untouched.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

package.nix

@@ -0,0 +1,40 @@
+{
+  lib,
+  python3Packages,
+}:
+python3Packages.buildPythonApplication {
+  pname = "legacy-email-proxy";
+  inherit ((lib.importTOML ./pyproject.toml).project) version;
+  pyproject = true;
+
+  # Only the files that affect the build, so editing the README or the CI
+  # workflow does not invalidate it.
+  src = lib.fileset.toSource {
+    root = ./.;
+    fileset = lib.fileset.unions [
+      ./proxy_server.py
+      ./pyproject.toml
+      ./requirements.txt
+      ./pytest.ini
+      ./tests
+    ];
+  };
+
+  build-system = [ python3Packages.setuptools ];
+  dependencies = [ python3Packages.aiosmtpd ];
+
+  nativeCheckInputs = [ python3Packages.pytestCheckHook ];
+
+  meta = {
+    description = "Unauthenticated POP3/SMTP front end proxied to authenticated IMAPS/SMTPS backends";
+    longDescription = ''
+      Exposes cleartext POP3 and SMTP to clients that cannot speak TLS or
+      modern authentication, and forwards them to an authenticated IMAPS/SMTPS
+      backend. The front-end listeners are unauthenticated by design and must
+      be confined to a trusted network.
+    '';
+    homepage = "https://code.emmathe.dev/lyrathorpe/legacy-email-proxy";
+    mainProgram = "legacy-email-proxy";
+    platforms = lib.platforms.unix;
+  };
+}