build: build frontend in Nix, remove static from git tracking

Add frontendDeps (FOD) and frontendStatic derivations to flake.nix so
that nix build handles the Vite bundle automatically. The archivr_server
derivation now copies from ${frontendStatic} instead of
${./crates/archivr-server/static}.

crates/archivr-server/static/ is excluded from git tracking (.gitignore);
the aarch64-darwin node_modules hash is included. Other systems use a
placeholder hash — run `nix build 2>&1 | grep 'got:'` to obtain theirs.

Update AGENTS.md and docs/README.md to reflect the new workflow.

AGENTS.md

@@ -74,11 +74,13 @@ cargo build --release -p archivr-server
 # Frontend (Bun, from frontend/)
 bun install
 bun run dev                        # Vite dev server
-bun run build                      # → ../crates/archivr-server/static (served by the server)
+bun run build                      # → ../crates/archivr-server/static (gitignored; only needed for bare cargo run)
 
 # Nix
 nix develop                        # devshell: yt-dlp, nushell, uv, twitter-api-client
-nix build .#archivr-server         # also .#archivr-cli, .#archivr-all
+nix build .#archivr-server         # also .#archivr-cli, .#archivr-all; builds frontend automatically
+                                   # If frontendDeps hash is stale (after bun.lock/package.json change):
+                                   #   nix build 2>&1 | grep "got:" → paste hash into flake.nix frontendDepsHash
 
 # Docker
 docker compose up -d               # port 8080; config in ./config/archivr-server.toml (see docker/config.example.toml)
@@ -131,7 +133,7 @@ No CI is configured; no rustfmt.toml/clippy.toml — default `cargo fmt`/`clippy
 - **Bun** is the frontend package manager (`frontend/bun.lock`); use `bun`, not npm/yarn.
 - Runtime binaries the app expects on PATH or via env vars: `yt-dlp`, Chromium, `single-file` (Node), Python 3 with `twitter-api-client`, `ffmpeg`. `nix develop` provides the dev subset.
 - `.gitignore` is **default-deny with an allowlist** — new top-level files/dirs are invisible to git until explicitly allowed there.
-- Frontend build output (`crates/archivr-server/static/`) is generated; never hand-edit it.
+- Frontend build output (`crates/archivr-server/static/`) is generated by the `frontendStatic` Nix derivation; never hand-edit it, and do not commit it — it is excluded from git tracking. `nix build` is the standard workflow everywhere (local and NixOS) and builds the frontend automatically. `bun run build` only needed for bare `cargo run` one-off testing. When `bun.lock` or `package.json` changes, update `frontendDepsHash` in `flake.nix` for each system by running `nix build 2>&1 | grep "got:"` and pasting the reported hash.
 - **yt-dlp is pinned to a specific GitHub release** in the `ytDlp` derivation in `flake.nix` (zipapp
   fetched from `github.com/yt-dlp/yt-dlp/releases`, wrapped with `python312` + `ffmpeg`) — not taken
   from nixpkgs. Both the `archivr` and `archivr-server` wrappers set `ARCHIVR_YT_DLP` from it. Three