feat(nix): add a dev shell and a checks output (task 0039)

`nix develop` now yields the toolchain the repository actually needs — Node,
`git`, `tea`, and `curl` — giving a declarative answer to "what do I need to
work on this", which the repository previously specified nowhere.

The shell takes its Node from the package's `passthru` rather than naming
`pkgs.nodejs` a second time, so development and the shipped artifact cannot
drift onto different majors and cannot be set independently. `package.nix`
declares that `passthru` as an interface rather than leaving the shell to read
an incidental build attribute; it does not enter the derivation, so the store
path is unchanged.

The checks output aliases the package, so `nix flake check` builds it and
thereby runs both its verification phases instead of being a silent no-op. No
per-stage checks: the only stage adding coverage is the full typecheck, which
spans `test/` and `bench/` and would drag the benchmark harness into the
derivation's inputs, undoing the source filtering. It stays in CI.

The shell deliberately omits `gitea-axi` itself. The benchmark's arm resolves
that binary by name off PATH and must get the locally built `dist/main.js`, so
supplying the packaged one would silently substitute the wrong artifact.

package.nix

@@ -160,6 +160,12 @@ buildNpmPackage {
     runHook postInstallCheck
   '';
 
+  # The Node the package is built against, published as a declared interface
+  # rather than left to be read off the build environment. The flake's dev shell
+  # consumes exactly this, so the two cannot drift onto different majors — and
+  # this attribute is why that holds, so removing it breaks the shell.
+  passthru = { inherit nodejs; };
+
   meta = {
     inherit (manifest) description homepage;