• Nix support: Added flake.nix, nix/package.nix, and nix/module.nix for building and running as a NixOS service. Enables services.framework-control.enable = true in NixOS configurations. Work in progress toward a nixpkgs submission.
• Removed bearer token auth: Write endpoints no longer require a bearer token. Security relies on CORS + loopback-only binding (127.0.0.1), which covers the actual threat model. Simplifies setup across all platforms — no token configuration needed.