ci: add GitHub Actions workflow running nix flake check

Uses Determinate Systems' nix-installer-action plus magic-nix-cache-action
to install Nix and cache builds across runs. Triggers on push and
pull_request. The single `nix flake check -L` covers the forgejo VM
test, the five keycloak tests (one VM, four nspawn containers), and
treefmt formatting.

Syntax is standard GitHub Actions / Forgejo-Actions-compatible per
CLAUDE.md, so the workflow ports unchanged if hosting moves.

Author: kmein

.github/workflows/ci.yml

@@ -0,0 +1,18 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: DeterminateSystems/nix-installer-action@main
+
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+
+      - name: nix flake check
+        run: nix flake check -L