build: drop the Nix packaging and test inside the container

The deployment target is a container on TrueNAS Scale, so the flake sat on no
path between the source and the NAS. It was carried over from a sibling project
where the flake is the deployment mechanism; here it only added a second build
path and a second dependency pin.

Worse, it tested the wrong thing: `nix flake check` ran the suite against
nixpkgs' ffmpeg while the shipped artefact contains Debian's, and encoder and
muxer behaviour is exactly what these tests cover.

The Dockerfile gains a `test` stage that installs pytest and runs the suite
against the image's own ffmpeg; a failing test fails the build. CI runs
`docker build --target test` in place of the host-based Python setup, and the
push build states `target: runtime` so the published image is the lean stage
rather than the last one in the file. The runtime image carries neither the
tests nor pytest.

The release step now calls python3 rather than python, since setup-python is
no longer in the job to provide the alias.

Removes package.nix, flake.nix and flake.lock. A dev shell is a `nix shell`
away for anyone who wants one, and the README says so.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-and-publish.yaml

@@ -43,20 +43,11 @@ jobs:
           # from the conventional-commit messages since the last release.
           fetch-depth: 0
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: 3.13
-
-      # The test suite runs real encodes, so ffmpeg is a test dependency.
-      - name: Install ffmpeg
-        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y ffmpeg
-
-      - name: Install test dependencies
-        run: python -m pip install --upgrade pip && pip install pytest
-
-      - name: Run unit tests
-        run: python -m pytest
+      # The suite runs inside the image, against the ffmpeg that ships, rather
+      # than against whatever the runner happens to provide. A failing test
+      # fails the build. Layers are shared with the push build below.
+      - name: Run the test suite inside the image
+        run: docker build --target test -t music-mirror:test .
 
       - name: Determine registry host
         run: echo "REGISTRY=${GITHUB_SERVER_URL#*://}" >> "$GITHUB_ENV"
@@ -145,6 +136,9 @@ jobs:
         uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
         with:
           context: .
+          # Without this the last stage in the Dockerfile -- the test stage --
+          # would be what gets published.
+          target: runtime
           # amd64 for the NAS, arm64 so the same image runs on a Pi.
           platforms: linux/amd64,linux/arm64
           push: ${{ github.event_name != 'pull_request' }}
@@ -165,7 +159,7 @@ jobs:
         run: |
           set -euo pipefail
 
-          python - "$VERSION" <<'PY'
+          python3 - "$VERSION" <<'PY'
           import pathlib
           import re
           import sys