romm-mcp: pin the real source and npmDeps hashes

Both come from the build, and both were non-obvious:

- fetchzip hashes the *unpacked* tree, not the .tgz bytes, so a hash computed
  from the published tarball does not match; the derivation reports the NAR hash
  of the extracted contents instead.
- npmDepsHash only exists once npm has materialised the dependency tree from the
  committed lockfile.

Verified with nix build .#romm-mcp: the derivation builds and ./result/bin/romm-mcp
starts and prints 'RomM MCP server running on stdio'.

packages/romm-mcp/package.nix

@@ -10,7 +10,7 @@ buildNpmPackage rec {
 
   src = fetchzip {
     url = "https://registry.npmjs.org/${pname}/-/${pname}-${version}.tgz";
-    hash = "sha256-Cg4Pa2jxwmMyuc2LyFJA1uNjFgaLaPgMXyvpY2HrPFM=";
+    hash = "sha256-SOYzG0CtNSvIrxOYJq3UDXRlXylqbDjo2f5qfpbiYmI=";
   };
 
   # Upstream publishes no package-lock.json (only package.json), and
@@ -18,7 +18,7 @@ buildNpmPackage rec {
   # from the published tarball itself -- `npm install --package-lock-only
   # --ignore-scripts` inside the extracted 1.0.5 package -- so it locks exactly
   # the dependency tree that shipped with this version.
-  npmDepsHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+  npmDepsHash = "sha256-oSlECdIf2ZP8ZZhOUChkcJAmUTj6TFTdeTJLY5RwLGo=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json