Add Nix flake: crane + fenix build, treefmt-nix formatting

Uses flake-parts to organize outputs, with nix/rust.nix defining a
single craneLib/toolchain/commonArgs environment shared by the package
build (nix/rust.nix) and the dev shell (nix/devshell.nix), so both stay
close to identical. Deps are cached separately from the crate itself via
crane's buildDepsOnly, giving incremental rebuilds. Checks cover clippy,
rustfmt, cargo-doc, cargo-audit, and nextest; treefmt-nix wires up
`nix fmt` for Rust/Nix/TOML files.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018ALEXkc7pTro7tF1WcUuKb

nix/devshell.nix

@@ -0,0 +1,38 @@
+# Dev shell built from the same craneLib/toolchain as the package build
+# (nix/rust.nix), so the environment developers see locally matches what
+# `nix build` uses as closely as possible.
+{
+  pkgs,
+  lib,
+  rust,
+}:
+rust.craneLib.devShell {
+  inherit (rust) checks;
+
+  packages =
+    with pkgs;
+    [
+      cargo-nextest
+      cargo-criterion
+      cargo-audit
+      cargo-expand
+      taplo
+      bacon
+    ]
+    ++ lib.optionals pkgs.stdenv.isLinux [ mold ]
+    ++ lib.optionals pkgs.stdenv.isDarwin [
+      libiconv
+      darwin.apple_sdk.frameworks.Security
+      darwin.apple_sdk.frameworks.SystemConfiguration
+    ];
+
+  shellHook = ''
+    export RUST_SRC_PATH="${rust.rustToolchain}/lib/rustlib/src/rust/library"
+  ''
+  + lib.optionalString pkgs.stdenv.isLinux ''
+    export CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER="clang"
+    export CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS="-C link-arg=-fuse-ld=mold"
+    export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER="clang"
+    export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_RUSTFLAGS="-C link-arg=-fuse-ld=mold"
+  '';
+}