fix: add NBXplorer cookie auth and WorkingDirectory for BTCPay service

- Add btcexplorercookiefile to BTCPay deterministic config so NBXplorer
  cookie authentication succeeds (fixes 401 Unauthorized)
- Set WorkingDirectory to package lib dir so ASP.NET Core can locate
  wwwroot and LanguageService.ctor does not throw ArgumentNullException
- Update regression test to assert cookie file path and WorkingDirectory

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>

modules/bitcoin/btcpayserver.nix

@@ -246,6 +246,8 @@ in {
 
       systemd.services.btcpayserver = let
         nbExplorerUrl = "http://${nbLib.addressWithPort cfg.nbxplorer.address cfg.nbxplorer.port}/";
+        nbExplorerCookie =
+          "${cfg.nbxplorer.dataDir}/${cfg.bitcoind.makeNetworkName "Main" "RegTest"}/.cookie";
         configFile = builtins.toFile "btcpayserver-config" (
           ''
             network=${cfg.bitcoind.network}
@@ -253,6 +255,7 @@ in {
             port=${toString cfg.btcpayserver.port}
             socksendpoint=${config.nix-bitcoin.torClientAddressWithPort}
             btcexplorerurl=${nbExplorerUrl}
+            btcexplorercookiefile=${nbExplorerCookie}
             explorer.postgres=User ID=${cfg.nbxplorer.user};Host=/run/postgresql;Database=nbxplorer
             postgres=User ID=${cfg.btcpayserver.user};Host=/run/postgresql;Database=btcpayserver
           '' + optionalString (cfg.btcpayserver.lightningBackend == "lnd")
@@ -273,6 +276,7 @@ in {
             ${cfg.btcpayserver.package}/bin/btcpayserver --conf=${configFile} \
               --datadir='${cfg.btcpayserver.dataDir}'
           '';
+          WorkingDirectory = "${cfg.btcpayserver.package}/lib/btcpayserver";
           RuntimeDirectory = "btcpayserver";
           StateDirectory = "btcpayserver";
           User = cfg.btcpayserver.user;

tests/bitcoin-btcpay-hardening.nix

@@ -50,6 +50,7 @@ let
   nbxplorerPreStart = config.systemd.services.nbxplorer.preStart;
   bitcoindPreStart = config.systemd.services.bitcoind.preStart;
   btcpayExecStart = config.systemd.services.btcpayserver.serviceConfig.ExecStart;
+  btcpayWorkingDir = config.systemd.services.btcpayserver.serviceConfig.WorkingDirectory;
 
   nbxplorerConfigPath = extractAfter "install -m 600" nbxplorerPreStart;
   btcpayConfigPath = extractFlagValue "--conf" btcpayExecStart;
@@ -92,6 +93,13 @@ assert lib.assertMsg
     && lib.hasInfix "port=24444" nbxplorerConfig
     && lib.hasInfix "postgres=User ID=nbxplorer;Host=/run/postgresql;Database=nbxplorer" nbxplorerConfig)
   "nbxplorer base config must contain the expected non-secret settings";
+assert lib.assertMsg
+  (lib.hasInfix "btcexplorerurl=http://127.0.0.1:24444/" btcpayConfig
+    && lib.hasInfix "btcexplorercookiefile=/build/nbxplorer/Main/.cookie" btcpayConfig)
+  "btcpayserver config must contain btcexplorerurl and btcexplorercookiefile";
+assert lib.assertMsg
+  (lib.hasSuffix "/lib/btcpayserver" btcpayWorkingDir)
+  "btcpayserver WorkingDirectory must end with /lib/btcpayserver";
 assert lib.assertMsg
   (!lib.hasInfix "/build/btcpayserver/settings.config" btcpayExecStart
     && lib.hasInfix "--datadir='/build/btcpayserver'" btcpayExecStart)