romm-mcp: pin the real source and npmDeps hashes

Both come from the build, and both were non-obvious:

- fetchzip hashes the *unpacked* tree, not the .tgz bytes, so a hash computed
  from the published tarball does not match; the derivation reports the NAR hash
  of the extracted contents instead.
- npmDepsHash only exists once npm has materialised the dependency tree from the
  committed lockfile.

Verified with nix build .#romm-mcp: the derivation builds and ./result/bin/romm-mcp
starts and prints 'RomM MCP server running on stdio'.

packages/default.nix

@@ -33,5 +33,6 @@
   pdf-mcp = pkgs.callPackage ./pdf-mcp/package.nix { };
   mcp-searxng = pkgs.callPackage ./mcp-searxng/package.nix { };
   python-ssh-mcp = pkgs.callPackage ./python-ssh-mcp/package.nix { };
+  romm-mcp = pkgs.callPackage ./romm-mcp/package.nix { };
   # example-mcp-server = pkgs.callPackage ./example-mcp-server/package.nix { };
 }

packages/romm-mcp/package.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchzip,
+}:
+
+buildNpmPackage rec {
+  pname = "romm-mcp";
+  version = "1.0.5";
+
+  src = fetchzip {
+    url = "https://registry.npmjs.org/${pname}/-/${pname}-${version}.tgz";
+    hash = "sha256-SOYzG0CtNSvIrxOYJq3UDXRlXylqbDjo2f5qfpbiYmI=";
+  };
+
+  # Upstream publishes no package-lock.json (only package.json), and
+  # buildNpmPackage requires one to compute npmDepsHash. This lock is generated
+  # from the published tarball itself -- `npm install --package-lock-only
+  # --ignore-scripts` inside the extracted 1.0.5 package -- so it locks exactly
+  # the dependency tree that shipped with this version.
+  npmDepsHash = "sha256-oSlECdIf2ZP8ZZhOUChkcJAmUTj6TFTdeTJLY5RwLGo=";
+
+  postPatch = ''
+    cp ${./package-lock.json} package-lock.json
+  '';
+
+  # dist/*.js (tsc output) ships inside the npm tarball, so there is nothing to
+  # compile here -- same arrangement as navidrome-mcp and n8n-mcp.
+  dontNpmBuild = true;
+
+  meta = with lib; {
+    description = "MCP server for RomM: browse, search and administrate a self-hosted ROM library";
+    homepage = "https://github.com/rodrigosiviero/romm-mcp";
+    license = licenses.mit;
+    mainProgram = pname;
+    platforms = platforms.all;
+  };
+}