Add Fly.io deployment for the App Store review test server

Adds a flyImage Nix output (backend + bundled web UI with an env-driven
startup config wrapper), a fly.toml with a persistent volume, and a deploy
README. Scanners are disabled and the API key comes from a Fly secret so
nothing sensitive is baked into the image. Also adds flyctl + skopeo to the
dev shell for daemon-less build/push.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/fly/fly.toml

@@ -0,0 +1,40 @@
+# Fly.io config for the OOTT App Store review test server.
+#
+# This deploys the backend (REST API + bundled Flutter web UI) as a single
+# always-on machine with a persistent volume for the SQLite database. It is a
+# throwaway, pay-as-you-go server: tear it down once review is done
+# (`fly apps destroy oott-test`).
+#
+# See deploy/fly/README.md for the full deploy procedure.
+
+app = "oott-test"            # change to your chosen Fly app name
+primary_region = "ams"       # change to a region near you / the reviewers
+
+# The image is built with Nix and pushed to the Fly registry (see README),
+# so there is no [build] section: deploy with `fly deploy --image ...`.
+
+[env]
+  OOTT_LOG_LEVEL = "info"
+  OOTT_NOTIFICATIONS_METHOD = "none"  # no push/pushover on the test server
+  OOTT_PORT = "8080"
+  OOTT_DATA_DIR = "/data"
+
+# Persistent SQLite storage. Create the volume once with:
+#   fly volumes create oott_data --region ams --size 1
+[[mounts]]
+  source = "oott_data"
+  destination = "/data"
+
+[http_service]
+  internal_port = 8080
+  force_https = true        # Apple ATS requires HTTPS for the app's API calls
+  # Keep the machine always on during review so a reviewer never hits a cold
+  # start. To save money once review is over, set auto_stop_machines = "stop"
+  # and min_machines_running = 0 to scale to zero.
+  auto_stop_machines = "off"
+  auto_start_machines = true
+  min_machines_running = 1
+
+[[vm]]
+  size = "shared-cpu-1x"
+  memory = "512mb"