RomM MCP server: browse, search and administrate a self-hosted ROM library,
including triggering library scans (POST /api/tasks/scan), which RomM 5.x only
exposes through its API.
Upstream ships no package-lock.json, so the lock committed here is generated from
the published 1.0.5 tarball (npm install --package-lock-only --ignore-scripts),
pinning exactly the tree that shipped with that version. dist/ is prebuilt in the
tarball, hence dontNpmBuild.
npmDepsHash is a placeholder: it can only be derived from the lockfile by a build,
so CI (nix flake check, which builds every package) reports the real value.
