build: switch from devenv to nix flakes with uv2nix

- Replace devenv setup with pure nix flakes using uv2nix, pyproject-nix,
  pyproject-build-systems, and git-hooks.nix (adapted from hokusai)
- Add forgejo CI pipeline with lint/check/test and build jobs
- Wrap cv binary with LD_LIBRARY_PATH for weasyprint native dependencies
- Move basedpyright to dev dependency group, add pytest and ruff
- Fix package imports to use hatch source remapping (src/ layout)
- Update .envrc to use flake, expand .gitignore

BREAKING CHANGE: devenv is no longer used, run direnv allow to reload

.gitignore

@@ -1,7 +1,18 @@
-*.pdf
+# Python-generated files
+__pycache__/
+*.py[oc]
+build/
+dist/
+wheels/
+*.egg-info
+
+# Virtual environments
+.venv
+
 .devenv
-.devenv.flake.nix
 .direnv
+.devenv.flake.nix
 .pre-commit-config.yaml
+
+# Nix
 result
-__pycache__