feat: add Rust backend — workspace with section executables

Cargo workspace with four crates:
- nixpanel-common: shared SectionRequest/SectionResponse types
- nixpanel-api: main Axum HTTP server (JWT auth, DB, routing)
- nixpanel-services: section binary for systemctl start/stop/restart
- nixpanel-sysinfo: section binary for CPU/RAM/disk/OS/version reads

nixpanel-api features:
- POST /api/auth/login — Argon2id verification, HS256 JWT
- GET  /api/dashboard  — real account counts + sysinfo + versions
- GET  /api/services   — live systemctl status via section binary
- POST /api/services/:name/:action — start/stop/restart
- GET  /api/accounts   — list from MariaDB
- POST /api/accounts   — create account + system user

Section binaries are UPX-compressed after build.
DB schema auto-migrated on first start; admin user seeded from
/opt/nixpanel/.admin_user + .admin_pass files.

Frontend changes:
- nixserver/src/api.ts + App.tsx wired to real API (JWT stored in
  localStorage, real data in dashboard/services/accounts)
- nixclient/src/api.ts added
- Both vite configs get /api proxy to localhost:4000 for dev
- install.sh updated to copy + compress all section binaries

nixpanel-common/Cargo.toml

@@ -0,0 +1,8 @@
+[package]
+name    = "nixpanel-common"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+serde      = { version = "1", features = ["derive"] }
+serde_json = "1"

nixpanel-common/src/lib.rs

@@ -0,0 +1,47 @@
+use serde::{Deserialize, Serialize};
+
+/// Every section binary reads one of these from stdin.
+#[derive(Debug, Serialize, Deserialize)]
+pub struct SectionRequest {
+    pub action: String,
+    #[serde(default)]
+    pub params: serde_json::Value,
+}
+
+/// Every section binary writes one of these to stdout.
+#[derive(Debug, Serialize, Deserialize)]
+pub struct SectionResponse {
+    pub success: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub data: Option<serde_json::Value>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
+
+impl SectionResponse {
+    pub fn ok<T: Serialize>(data: T) -> Self {
+        Self {
+            success: true,
+            data: Some(serde_json::to_value(data).unwrap_or(serde_json::Value::Null)),
+            error: None,
+        }
+    }
+
+    pub fn err(msg: impl ToString) -> Self {
+        Self {
+            success: false,
+            data: None,
+            error: Some(msg.to_string()),
+        }
+    }
+}
+
+/// Shared service descriptor used by both sysinfo and services sections.
+#[derive(Debug, Serialize, Deserialize, Clone)]
+pub struct ServiceInfo {
+    pub name: String,
+    pub display: String,
+    pub status: String, // "running" | "stopped" | "warning"
+    pub pid: Option<u32>,
+    pub uptime: Option<String>,
+}