Update build procedures and documentation

flake.nix

@@ -34,7 +34,20 @@
             };
           in
           {
-            packages.default = pkgs.callPackage ./nix/package.nix { };
+            # Version and API key are injected from the ambient environment on
+            # impure evals (CI sets APP_VERSION/API_KEY from the git ref and a
+            # secret). Pure evals (`nix flake check`, local `nix build`) can't
+            # see the environment, so builtins.getEnv returns "" and the
+            # package falls back to its 0.1.0 default / no auth header.
+            packages.default =
+              let
+                envVersion = builtins.getEnv "APP_VERSION";
+                envApiKey = builtins.getEnv "API_KEY";
+                packageArgs =
+                  { apiKey = envApiKey; }
+                  // (nixpkgs.lib.optionalAttrs (envVersion != "") { version = envVersion; });
+              in
+              pkgs.callPackage ./nix/package.nix packageArgs;
 
             devShells.default = pkgs.mkShell {
               inputsFrom = [ self.packages.${system}.default ];
@@ -55,6 +68,7 @@
                 echo "RadiantWave dev shell (APP_VERSION=dev, API_KEY=$([[ -n "$API_KEY" ]] && echo set || echo unset))"
                 echo "  Configure: cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug"
                 echo "  Bake version+key: cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug -DAPP_VERSION=\"1.2.3\" -DAPI_KEY=\"<key>\""
+                echo "  Nix build (env version+key, impure): APP_VERSION=... API_KEY=... nix build --impure .#default"
                 echo "  Build:     cmake --build build"
                 echo "  Run:       ./build/radiantwave"
                 echo "  Tests:     ./build/test_assets && ./build/test_<name>"