Add a Nix flake for the dev shell and package build

The devShell carries the toolchain plus the X11, Wayland, Vulkan,
fontconfig and freetype libraries winit and wgpu dlopen at run time,
and the trunk/wasm-bindgen pair the web build needs. LD_LIBRARY_PATH
is set there too, since a dev binary runs straight out of ./target and
never gets the wrapper the package build applies.

The four git dependencies each need an entry in cargoLock.outputHashes.
They are lib.fakeHash for now; the first `nix build` prints the real
values, and they have to be refreshed whenever a rev in Cargo.toml
moves.

.gitignore

@@ -35,3 +35,6 @@ __pycache__/
 
 # Claude Code local preview/dev-server config
 .claude/launch.json
+
+# nix-direnv
+.direnv/