Add Nix flake and npm lock for CLI app
Add apps/cli/flake.nix and flake.lock and commit package-lock.json.
Register the CLI flake as "rocksky-cli" in the root flake and include
its package in the top-level devShell. Remove apps/cli from the JS
workspaces and update apps/cli/.gitignore to ignore build results.
update flake.nix