feat(WP-0018/R1): add OCI container image build to flake.nix

packages.docker using dockerTools.buildLayeredImage wraps the IHP
production binary with cacert for Anthropic API calls. Push target:
92.205.130.254:32166/coulomb/inter-hub:TAG via skopeo.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

flake.nix

@@ -18,7 +18,10 @@
             systems = import systems;
             imports = [ ihp.flakeModules.default ];
 
-            perSystem = { pkgs, ... }: {
+            perSystem = { pkgs, config, ... }: let
+                # IHP production binary — built by the ihp flake module as packages.default
+                appPkg = config.packages.default;
+            in {
                 ihp = {
                     appName = "inter-hub";
                     enable = true;
@@ -77,6 +80,28 @@
                     # static.makeBundling = true; # Set false if not using Makefile for CSS/JS bundling
                 };
 
+                # OCI container image for Kubernetes deployment (Railiance01)
+                # Build: nix build .#docker
+                # Push:  skopeo copy docker-archive:result docker://92.205.130.254:32166/coulomb/inter-hub:TAG
+                packages.docker = pkgs.dockerTools.buildLayeredImage {
+                    name = "inter-hub";
+                    tag = "latest";
+                    contents = with pkgs; [
+                        appPkg    # IHP binary + bundled static files + migrations
+                        cacert    # SSL certs for outbound HTTPS (Anthropic API)
+                        bash      # needed by IHP's production entrypoint scripts
+                        coreutils
+                    ];
+                    config = {
+                        Cmd = [ "${appPkg}/bin/inter-hub" ];
+                        ExposedPorts."8000/tcp" = {};
+                        Env = [
+                            "PORT=8000"
+                            "IHP_ENV=Production"
+                        ];
+                    };
+                };
+
                 # Custom configuration that will start with `devenv up`
                 devenv.shells.default = {
                     # Start Mailhog on local development to catch outgoing emails