M5: documentation, packaging, and verified nix build

Rewrite README with tested examples, config reference table, unlock
method matrix, NixOS-specific notes on LD_LIBRARY_PATH for cryptsetup
token plugins, FIDO2 enrollment instructions, and troubleshooting
section. Verify nix build produces working binary with version injection.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

flake.lock

@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1774244481,
+        "narHash": "sha256-4XfMXU0DjN83o6HWZoKG9PegCvKvIhNUnRUI19vzTcQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "4590696c8693fea477850fe379a01544293ca4e2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}