Add automated NixOS VM test and CLAUDE.md

Adds a pkgs.testers.nixosTest (checks.<system>.invoiceninja) that boots
the module end-to-end and checks that mysql/redis/phpfpm/queue-worker/
nginx come up, the one-time migrate/seed/admin-create setup completed,
the app shell and /login page are served, invoiceninja-manage works,
and the seeded admin can log in via the API.

Factors the shared services.invoiceninja config used by both the
interactive VM and the new test into tests/common.nix, and satisfies
NixOS's fileSystems/bootloader assertions in the interactive VM config
so `nix flake check` evaluates nixosConfigurations.test cleanly (the
qemu-vm module already overrides both when actually building
config.system.build.vm, so this only affects the toplevel-eval path).

Also adds a `just test` recipe, a CLAUDE.md codebase overview, and a
.gitignore for the result/nixos.qcow2 build artifacts.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/default.nix

@@ -3,25 +3,26 @@
 {
   imports = [
     (modulesPath + "/profiles/qemu-guest.nix")
-    ../nixos-module/invoiceninja.nix
+    ./common.nix
   ];
 
+  # Required to build pkgs.chromium, which the module pulls in for PDF generation.
   nixpkgs.config.allowUnfree = true;
 
+  # `nix flake check` evaluates config.system.build.toplevel directly, which asserts a real root
+  # filesystem and bootloader are configured. `just build-vm` builds config.system.build.vm
+  # instead, where the qemu-vm module overrides both of these with a tmpfs root and direct
+  # kernel boot (virtualisation.useBootLoader defaults to false) - so these values just need to
+  # satisfy the assertions and are otherwise unused.
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "ext4";
+  };
+  boot.loader.grub.enable = false;
+
   users.users.root = {
     initialPassword = "toor";
   };
 
-  services.invoiceninja = {
-    enable = true;
-    proxy.server = "nginx";
-    adminAccount.passwordFile = ./invoice_ninja_test_password;
-    secretFile = ./test.env;
-    settings.APP_DEBUG = true;
-  };
-
-  networking.firewall.enable = false;
-
   services.resolved.enable = true;
 }
-