Add Nix flake: devShell + hermetic nonRoot debug APK build

- flake.nix: devShells.default (JDK 17 + Android SDK 34 / NDK 27.0.12077973 + Gradle)
  and packages.moonlight-android (assembleNonRootDebug via gradle mitmCache)
- deps.json: offline Maven lockfile (195 artifacts)
- nix-deps-fixup.gradle: skip androidTest variant ambiguity during dep capture
- README: Building with Nix section

README.md

@@ -24,6 +24,36 @@ You can follow development on our [Discord server](https://moonlight-stream.org/
 * In moonlight-android/, create a file called ‘local.properties’. Add an ‘ndk.dir=’ property to the local.properties file and set it equal to your NDK directory.
 * Build the APK using Android Studio or gradle
 
+## Building with Nix
+
+A `flake.nix` provides a reproducible dev environment and a fully hermetic
+debug-APK build (Android SDK 34, NDK 27.0.12077973, Gradle, JDK 17). All
+commands need `?submodules=1` so the `moonlight-common-c` + `enet` submodule
+sources are included in the build.
+
+```sh
+# Dev shell: ANDROID_HOME / ANDROID_NDK_ROOT / JAVA_HOME + gradle, then build by hand
+nix develop '.?submodules=1'
+./gradlew assembleNonRootDebug
+
+# Hermetic, offline build of the nonRoot debug APK (output in ./result/)
+nix build '.?submodules=1#moonlight-android'
+ls result/app-nonRoot-debug.apk
+```
+
+Maven dependencies are pinned in `deps.json` (a Nixpkgs Gradle mitm-cache
+lockfile). Regenerate it after changing dependencies:
+
+```sh
+nix build '.?submodules=1#moonlight-android.mitmCache.updateScript' && ./result
+```
+
+Notes:
+* If your Nix is configured to offload to a remote builder, add `--builders ""`
+  to build locally instead of copying the multi-GB SDK closure to the remote.
+* The build targets the `nonRoot` `debug` variant; it is signed with the
+  generated Android debug keystore (not a release key).
+
 ## Authors
 
 * [Cameron Gutman](https://github.com/cgutman)