feat(MM-135): NixOS module for relay deployment #12

Summary#

Add nix/module.nix: complete NixOS module with services.ezpds.* option tree, TOML config generation via pkgs.formats.toml, configFile escape hatch for agenix/sops-nix, dedicated ezpds user/group, and hardened systemd service
Expose nixosModules.default in flake.nix with package injection via lib.mkDefault self.packages.${pkgs.system}.relay
Add just nix-check recipe (nix flake check --impure --accept-flake-config) for ongoing validation; all 18 acceptance criteria verified via nix eval smoke tests

just nix-check exits 0
cargo test --workspace — 20 tests pass
cargo clippy --workspace -- -D warnings — clean
Run Phase 3 smoke tests from docs/implementation-plans/2026-03-09-MM-135/phase_03.md Tasks 1–5 (note: requires builtins.getFlake "nixpkgs" workaround documented in the file — devenv-nixpkgs fork lacks lib.nixosSystem)
Review human test plan at docs/test-plans/2026-03-09-MM-135.md for E2E and runtime verification steps (Linux VM required)