fix(nix): build under pnpm_9 + drop stale NDK substitute

NDK 2.8.1 → 3.0.3 bump (041f431) regenerated pnpm-lock.yaml at
lockfile v9, which pnpm_8 refuses to read. Switch the derivation to
pnpm_9 and regen the pnpmDeps hash to match the v9 lockfile.

The package.json/pnpm-lock realignment that `patchNdk` used to fix is
no longer needed — the same bump also pinned NDK as `"3.0.3"` in
package.json, so manifest + lockfile already agree. Drop the
substitute (kept as a no-op shim for the next time a bump diverges
them) instead of carrying a substituteStream that errors out under
--replace-fail because the source string no longer exists.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

package.nix

@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  pnpm_8,
+  pnpm_9,
   nodejs_20,
   makeWrapper,
   prisma-engines,
@@ -13,19 +13,13 @@
 }:
 
 let
-  # Fork commit `06272c8` ("pin @nostr-dev-kit/ndk to 2.8.1 instead of
+  # The NDK 2.8.1 → 3.0.3 bump (commit 041f431) regenerated pnpm-lock.yaml
-  # workspace:*") changed package.json to a pinned `"2.8.1"`, but the
+  # at lockfile v9 and pinned NDK as `"3.0.3"`. Lockfile + manifest agree
-  # pnpm-lock.yaml still expresses the spec as `"^2.8.1"` (the way
+  # post-bump, so the historical patch-back-to-caret-form is no longer
-  # `pnpm add` originally generated it). pnpm with --frozen-lockfile
+  # required. Leave the no-op shim in place as a structural anchor; if a
-  # rejects that mismatch. Patching package.json to use the caret form
+  # future bump regenerates the lockfile under a non-caret manifest spec
-  # is non-semantic (2.8.1 is still the resolved version) and aligns
+  # again, this is the seam where the realignment goes.
-  # both files. Same fix the Dockerfile-side already handles via
+  patchNdk = "";
-  # `--no-frozen-lockfile`; in nix we prefer frozen + a targeted patch.
-  patchNdk = ''
-    substituteInPlace package.json \
-      --replace-fail '"@nostr-dev-kit/ndk": "2.8.1"' \
-                     '"@nostr-dev-kit/ndk": "^2.8.1"'
-  '';
 
   prismaEnv = {
     PRISMA_SCHEMA_ENGINE_BINARY = lib.getExe' prisma-engines "schema-engine";
@@ -42,18 +36,18 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = ./.;
 
-  pnpmDeps = pnpm_8.fetchDeps {
+  pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 2;
     prePnpmInstall = patchNdk;
-    hash = "sha256-dQ+TX5jf1ZQKGoPCZgWaFwpAC3uP6iL1ZSxS0mFNdP8=";
+    hash = "sha256-nmjZ2oTw8K4lTA+2gdtWXX7TnM0n39OwvbwG3DBQ9WU=";
   };
 
   postPatch = patchNdk;
 
   nativeBuildInputs = [
-    pnpm_8.configHook
+    pnpm_9.configHook
-    pnpm_8
+    pnpm_9
     nodejs_20
     makeWrapper
     node-gyp