Build front-end via Nix and harden Docker/Nix image generation

- Build the Flutter web app at release time (nix/frontend.nix) and bundle
  it next to the binary at $out/share/oott/web; resolve it at runtime
  relative to the executable. Remove the prebuilt backend/web from git.
- Add web_server.{ip_address,port,api_key} options to the NixOS module so
  the generated config deserializes (was missing, causing a startup panic).
- Docker image: set SSL_CERT_FILE for outbound TLS, drop the heavy
  nixos/nix base image, trim contents to [oott cacert], and ensure /tmp
  exists.
- Remove the unused "nix" flake input and commit flake.lock.
- Provide Swagger UI to utoipa-swagger-ui offline via a pinned fetchurl so
  the package builds in the Nix sandbox; skip the redundant check phase
  (tests run via backend/run_tests.sh).
- sample_oott.toml: set database.path to /db/oott.db for the Docker image.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nix/frontend.nix

@@ -0,0 +1,12 @@
+{flutter}:
+flutter.buildFlutterApplication {
+  pname = "oott-frontend";
+  version = "0.1.0";
+  src = ./../frontend;
+
+  # Fetches pub dependencies from the committed pubspec.lock (all hosted, no git deps).
+  autoPubspecLock = ./../frontend/pubspec.lock;
+
+  # Build the web bundle (the backend serves these assets).
+  targetFlutterPlatform = "web";
+}