Add romm-mcp package

RomM MCP server: browse, search and administrate a self-hosted ROM library,
including triggering library scans (POST /api/tasks/scan), which RomM 5.x only
exposes through its API.

Upstream ships no package-lock.json, so the lock committed here is generated from
the published 1.0.5 tarball (npm install --package-lock-only --ignore-scripts),
pinning exactly the tree that shipped with that version. dist/ is prebuilt in the
tarball, hence dontNpmBuild.

npmDepsHash is a placeholder: it can only be derived from the lockfile by a build,
so CI (nix flake check, which builds every package) reports the real value.

packages/romm-mcp/package.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchzip,
+}:
+
+buildNpmPackage rec {
+  pname = "romm-mcp";
+  version = "1.0.5";
+
+  src = fetchzip {
+    url = "https://registry.npmjs.org/${pname}/-/${pname}-${version}.tgz";
+    hash = "sha256-Cg4Pa2jxwmMyuc2LyFJA1uNjFgaLaPgMXyvpY2HrPFM=";
+  };
+
+  # Upstream publishes no package-lock.json (only package.json), and
+  # buildNpmPackage requires one to compute npmDepsHash. This lock is generated
+  # from the published tarball itself -- `npm install --package-lock-only
+  # --ignore-scripts` inside the extracted 1.0.5 package -- so it locks exactly
+  # the dependency tree that shipped with this version.
+  npmDepsHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+
+  postPatch = ''
+    cp ${./package-lock.json} package-lock.json
+  '';
+
+  # dist/*.js (tsc output) ships inside the npm tarball, so there is nothing to
+  # compile here -- same arrangement as navidrome-mcp and n8n-mcp.
+  dontNpmBuild = true;
+
+  meta = with lib; {
+    description = "MCP server for RomM: browse, search and administrate a self-hosted ROM library";
+    homepage = "https://github.com/rodrigosiviero/romm-mcp";
+    license = licenses.mit;
+    mainProgram = pname;
+    platforms = platforms.all;
+  };
+}