feat: add NixOS module for declarative deployment

Adds nixos-module.nix with services.oubliette options (enable, package,
settings, configFile) and a hardened systemd service. Exposes the module
as nixosModules.default in flake.nix.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

flake.nix

@@ -11,6 +11,8 @@
       forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
     in
     {
+      nixosModules.default = import ./nixos-module.nix;
+
       packages = forAllSystems (system:
         let
           pkgs = nixpkgs.legacyPackages.${system};