build(nix): pin the Rust toolchain to 1.97.1 via rust-overlay

nixpkgs 26.05 ships rustc 1.95.0, but this crate was developed and verified on
1.97.1 (what CachyOS had, installed 2026-07-17). Taking the compiler from
oxalica/rust-overlay decouples "which Rust the project targets" from "which
release the audio stack came from", so a nixpkgs bump can no longer move the
compiler under the lint gate as a side effect.

Chosen over rustup, which would also have worked here (nix-ld is enabled, so
its prebuilt binaries run) and would have let one rust-toolchain.toml cover the
packaging distroboxes too. The deciding factor is purity: rustup records
nothing in flake.lock, so a fresh clone or darp5 would resolve whatever it
fetched that day. rust-overlay gives the same exact-version control with the
choice pinned in the lock.

`.default` is the rustup "default" profile — rustc, cargo, rust-std, rustfmt
and clippy — so those are no longer listed individually. rust-src and the
x86_64-pc-windows-gnu target are added for win-cross-build.sh, which needs
`-Z build-std=std,panic_abort`; that script still expects the peerspeak-win
distrobox for the mingw half.

Verified on 1.97.1: 640 lib tests pass, fmt clean.

NOT fixed here, and pre-existing rather than a migration artifact:
`cargo clippy --all-targets -- -D warnings` fails with 15 warnings — 13
`float_literal_f32_fallback` (bare 0.05/0.01 into `.step()`, wants `0.05_f32`),
one `manual implementation of Option::filter`, one `redundant reference in
format!`, all in src/app/mod.rs. The f32 lint is `future_incompatible` and is
slated to become a hard error, so it needs fixing regardless of platform.
CachyOS was already on 1.97.1 well before the 2026-07-31 S2 merge logged as
"clippy clean", so that claim reflects a plain `cargo clippy` run, which exits
0 on warnings. `cargo clippy --fix` applies all 15 automatically.

flake.lock

@@ -18,7 +18,28 @@
     },
     "root": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "rust-overlay": "rust-overlay"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1786076960,
+        "narHash": "sha256-jfR6OhwurCKn1tREyfOcK/Omxf1Q/DzDDFbnEr1mBLs=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "57a23bfaf4f7017267294b161175db1e32eb1c85",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
       }
     }
   },

flake.nix

@@ -1,18 +1,57 @@
 {
   description = "PeerSpeak — decentralized P2P voice chat (Rust/iroh/PipeWire/Opus/iced)";
 
-  # Pinned to the same channel the hosts run (nixos-config tracks nixos-26.05),
-  # so the libraries this shell links and dlopens are built against the same
-  # release as the PipeWire daemon and Vulkan ICD actually running on the
-  # machine. Floating to unstable here would reintroduce precisely the
-  # client/server version skew the pin exists to prevent.
-  inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-26.05";
+  inputs = {
+    # Pinned to the same channel the hosts run (nixos-config tracks
+    # nixos-26.05), so the libraries this shell links and dlopens are built
+    # against the same release as the PipeWire daemon and Vulkan ICD actually
+    # running on the machine. Floating to unstable here would reintroduce
+    # precisely the client/server version skew the pin exists to prevent.
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-26.05";
+
+    # The Rust toolchain is pinned SEPARATELY from the system libraries, and
+    # deliberately so. nixpkgs 26.05 ships rustc 1.95.0, but this crate was
+    # developed and verified against 1.97.1 — close enough to build and pass
+    # every test, but not close enough for clippy, which flags a
+    # `collapsible_match` on 1.95 that 1.97 does not. Taking the compiler from
+    # here decouples "which Rust the project targets" from "which release the
+    # audio stack came from", so a nixpkgs bump can never silently move the
+    # compiler under the lint gate again.
+    #
+    # This is the reproducible alternative to rustup: same exact-version
+    # control, but the choice is recorded in flake.lock, so darp5 or a fresh
+    # clone resolves the identical toolchain instead of whatever rustup happens
+    # to fetch that day.
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
 
   outputs =
-    { nixpkgs, ... }:
+    { nixpkgs, rust-overlay, ... }:
     let
       system = "x86_64-linux";
-      pkgs = nixpkgs.legacyPackages.${system};
+      pkgs = import nixpkgs {
+        inherit system;
+        overlays = [ rust-overlay.overlays.default ];
+      };
+
+      # Matches what CachyOS shipped (rust 1:1.97.1-1), which is the toolchain
+      # every green result in the handoff was produced with.
+      #
+      # `default` is the rustup "default" profile — rustc, cargo, rust-std,
+      # rustfmt and clippy — so those are NOT listed separately below.
+      #
+      # rust-src and the windows-gnu target exist for win-cross-build.sh, which
+      # needs `-Z build-std=std,panic_abort` for the self-contained .exe. That
+      # script still expects to run in the peerspeak-win distrobox for the
+      # mingw toolchain; carrying the target here just means the Rust half is
+      # already in place if it is ever driven from the host.
+      rustToolchain = pkgs.rust-bin.stable."1.97.1".default.override {
+        extensions = [ "rust-src" ];
+        targets = [ "x86_64-pc-windows-gnu" ];
+      };
 
       # Libraries that iced/winit/wgpu open with dlopen at RUNTIME rather than
       # linking at build time. Because nothing links them, they never land in
@@ -53,12 +92,10 @@
     in
     {
       devShells.${system}.default = pkgs.mkShell {
-        nativeBuildInputs = with pkgs; [
-          rustc
-          cargo
-          rustfmt
-          clippy
-
+        nativeBuildInputs = [
+          rustToolchain
+        ]
+        ++ (with pkgs; [
           # The supply-chain gates .gitea/workflows/ci.yml runs, so the same
           # checks are reproducible locally before a push. These were `cargo
           # install`ed on the CachyOS side, which does not carry over — those
@@ -86,7 +123,7 @@
           # build.rs shells out to `git rev-parse --short=8 HEAD` to stamp
           # PEERSPEAK_GIT_SHORT into the binary (surfaced in Settings).
           git
-        ]
+        ])
         ++ screenshareTools
         ++ [
           pkgs.pulseaudio # `pactl`, used by pixelpass's audio routing