fix(flake.nix): fix site build & add missing inputs for darwin hosts (#16153)

- update `flake.nix`:
  - use `devShells.default` instead of `devShell`
  - include macOS-specific build inputs
  - use the same nodejs version in the default devShell and pnpm frontend build
- update `site/.npmrc` to include tarball URLs for a reproducible Nix build.

Change-Id: I28f0e301298806f251121cc93224740bcc02bcba
Signed-off-by: Thomas Kosiewski <tk@coder.com>

flake.nix

@@ -32,7 +32,7 @@
           inherit system;
         };
 
-        nodejs = pkgs.nodejs-18_x;
+        nodejs = pkgs.nodejs_20;
         # Check in https://search.nixos.org/packages to find new packages.
         # Use `nix --extra-experimental-features nix-command --extra-experimental-features flakes flake update`
         # to update the lock file if packages are out-of-date.
@@ -88,6 +88,7 @@
           less
           mockgen
           moreutils
+          nix-prefetch-git
           nfpm
           nodejs
           neovim
@@ -119,9 +120,17 @@
 
         # buildSite packages the site directory.
         buildSite = pnpm2nix.packages.${system}.mkPnpmPackage {
+          inherit nodejs;
+
           src = ./site/.;
           # Required for the `canvas` package!
-          extraBuildInputs = with pkgs; [ pkgs.cairo pkgs.pango pkgs.pixman ];
+          extraBuildInputs = with pkgs; [
+            cairo
+            pango
+            pixman
+            libpng libjpeg giflib librsvg
+            python312Packages.setuptools
+          ] ++ ( lib.optionals stdenv.targetPlatform.isDarwin [ darwin.apple_sdk.frameworks.Foundation xcbuild ] );
           installInPlace = true;
           distDir = "out";
         };
@@ -161,15 +170,18 @@
           };
       in
       {
-        devShell = pkgs.mkShell {
-          buildInputs = devShellPackages;
-          shellHook = ''
-            export PLAYWRIGHT_BROWSERS_PATH=${pkgs.playwright-driver.browsers}
-            export PLAYWRIGHT_SKIP_VALIDATE_HOST_REQUIREMENTS=true
-          '';
+        devShells = {
+          default = pkgs.mkShell {
+            buildInputs = devShellPackages;
+            shellHook = ''
+              export PLAYWRIGHT_BROWSERS_PATH=${pkgs.playwright-driver.browsers}
+              export PLAYWRIGHT_SKIP_VALIDATE_HOST_REQUIREMENTS=true
+            '';
 
-          LOCALE_ARCHIVE = with pkgs; lib.optionalDrvAttr stdenv.isLinux "${glibcLocales}/lib/locale/locale-archive";
+            LOCALE_ARCHIVE = with pkgs; lib.optionalDrvAttr stdenv.isLinux "${glibcLocales}/lib/locale/locale-archive";
+          };
         };
+
         packages = {
           proto_gen_go = proto_gen_go_1_30;
           all = pkgs.buildEnv {